CVE-2026-98690 thunderbolt: Fix domain reference leak when DPRX read is canceled

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix domain reference leak when DPRX read is canceled tbtunnelonedp takes a domain reference which is only dropped once tbdptunnelactive has run on the work queue. If that work is cancelled that reference is leaked...

CVE-2026-98690

The Linux kernel contains a vulnerability in the thunderbolt driver where a domain reference is leaked when a DPRX read is canceled. Specifically, the tb_tunnel_one_dp() function takes a reference that is only dropped once; if tb_dp_tunnel_active() work is canceled, the reference remains leaked. ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: soc: ti: k3-socinfo: Fixed the regmap leak that occurs during probe failures. The mmio regmap allocated during the probe never gets freed. We have switched to using the device-managed allocator, so that the regmap is released...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: spi: s3c64xx: fixed NULL dereferencing on driver unbind. A change that moved DMA channel allocation from probe back to s3c64xxspipreparetransfer failed to remove the corresponding deallocation from remove. The bogus DMA channel...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: davinci: vpif: Fixed a use-after-free issue during the driver unbind operation. The driver allocates and registers two platform device structures during the probe phase. However, these devices were never deregistered after...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tty: goldfish: Fix freeirq on remove By passing the correct devid to freeirq, this issue can be fixed when the driver is unbound. WARNING: CPU: 0, PID: 30, at kernel/irq/manage.c:1895 – freeirq Trying to free an already freed IRQ...

SUSE CVE-2026-97962

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor netdev unload path, which is not serialized by the devlink instance loc...

DEBIAN-CVE-2026-97962

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor netdev unload path, which is not serialized by the devlink instance loc...

AZL-104487 CVE-2026-97962 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor netdev unload path, which is not serialized by the devlink instance loc...

CVE-2026-97962

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor netdev unload path, which is not serialized by the devlink instance loc...

CVE-2026-98008

The Linux kernel contains a NULL pointer dereference vulnerability within the net: macb driver. When the device tree describes a fixed-link without an "mdio" child node, the macb_mii_init() function returns early without allocating the MDIO bus, leaving bp->mii_bus as NULL . This causes a kern...

CVE-2026-97962

The Linux kernel contains a vulnerability in the net/mlx5e driver where the representor vnic devlink health reporter is created and destroyed along a path not serialized by the devlink instance lock. This lack of serialization triggers a devl_assert_locked() splat during driver unbind. The issue ...

Linux Distros Unpatched Vulnerability : CVE-2026-97962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor...

CVE-2026-97962

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor netdev unload path, which is not serialized by the devlink instance loc...

PT-2026-97935

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/xe component where the kernel may be tainted due to an unexpected warning during driver unbind. When a device is wedged in mode 2 UPON ANY HANG NO RESET, a GSC...

CVE-2026-90270

CVE-2026-90270 affects the arm_mpam driver in the Linux kernel . A use-after-free occurs when a user unbinds the last Memory System Component (MSC) for a given component, causing the corresponding mpam_component to be freed. A subsequent read of the schemata file in the resctrl filesystem then ac...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Memory: mtk-smi – fixed the device leak during the larb probe. Make sure to remove the references made when checking the SMI device during a larb probe, especially in cases of late probe failures e.g., probe deferral or when t...

Astra Linux – Vulnerability in Linux, Linux 5.10

A vulnerability was discovered in the Linux kernel, where a use-after-free condition could occur in nouveau’s postclose handler if a device is removed. This situation occurs when removing a device—a process that isn’t common for physically removing a video card without shutting down the system...

Linux Distros Unpatched Vulnerability : CVE-2026-89738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: at91udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode board.vbuspin && board.vbuspolled, probe arms a self-restarting cycle...

Linux Distros Unpatched Vulnerability : CVE-2026-89625

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: sony: fix UAF of ghlpoketimer / ghlurb at driver unbind For GHL Guitar Hero Live dongles, sonyprobe arms a periodic timer: ghlmagicpoke the timer callback...