CVE-2026-98198 hwmon: (pwm-fan) Stop RPM timer before freeing tach data

In the Linux kernel, the following vulnerability has been resolved: hwmon: pwm-fan Stop RPM timer before freeing tach data sampletimer rearms the RPM timer and accesses the devm-managed ctx-tachs and ctx-pulsesperrevolution arrays. The cleanup action which stops the timer is registered before tho...

CVE-2026-98197 hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove

In the Linux kernel, the following vulnerability has been resolved: hwmon: w83791d remove fan/pwm 4-5 sysfs group on remove When the fan/pwm 4-5 pins are not used as GPIO, w83791dprobe creates the w83791dgroupfanpwm45 sysfs group on the I2C client device. The probe error path removes this group...

EUVD-2026-93124

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: fix UAF in brcmsfreetimer brcmsfreetimer calls brcmsdeltimer which uses the non-synchronous canceldelayedwork to cancel the timer's underlying delayed work. If the work callback brcmstimer is already running,...

CVE-2026-98196 wifi: brcmsmac: fix UAF in brcms_free_timer()

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: fix UAF in brcmsfreetimer brcmsfreetimer calls brcmsdeltimer which uses the non-synchronous canceldelayedwork to cancel the timer's underlying delayed work. If the work callback brcmstimer is already running,...

CVE-2026-98196 wifi: brcmsmac: fix UAF in brcms_free_timer()

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: fix UAF in brcmsfreetimer brcmsfreetimer calls brcmsdeltimer which uses the non-synchronous canceldelayedwork to cancel the timer's underlying delayed work. If the work callback brcmstimer is already running,...

CVE-2026-98196

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: fix UAF in brcmsfreetimer brcmsfreetimer calls brcmsdeltimer which uses the non-synchronous canceldelayedwork to cancel the timer's underlying delayed work. If the work callback brcmstimer is already running,...

EUVD-2026-93123

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: fix broadcast stations deallocation On the error path of il4965up, ildeallocbcaststations clears only ILSTAUCODEACTIVE, leaving ILSTABCAST set. This causes the same broadcast stations to be deallocated again by...

CVE-2026-98195 wifi: iwlegacy: fix broadcast stations deallocation

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: fix broadcast stations deallocation On the error path of il4965up, ildeallocbcaststations clears only ILSTAUCODEACTIVE, leaving ILSTABCAST set. This causes the same broadcast stations to be deallocated again by...

CVE-2026-98195

The Linux kernel contains a vulnerability in the wifi: iwlegacy component related to how broadcast stations are deallocated. Specifically, in the error path of __il4965_up(), the function il_dealloc_bcast_stations() incorrectly clears only the IL_STA_UCODE_ACTIVE flag while leaving IL_STA_BCAST s...

CVE-2026-98194 wifi: libertas_tf: fix UAF in lbtf_free_adapter()

In the Linux kernel, the following vulnerability has been resolved: wifi: libertastf: fix UAF in lbtffreeadapter lbtffreeadapter calls lbtffreecmdbuffer to free the command buffers before calling timerdeletesync to wait for the command timer callback. If the timer callback commandtimerfn is alrea...

EUVD-2026-93122

In the Linux kernel, the following vulnerability has been resolved: wifi: libertastf: fix UAF in lbtffreeadapter lbtffreeadapter calls lbtffreecmdbuffer to free the command buffers before calling timerdeletesync to wait for the command timer callback. If the timer callback commandtimerfn is alrea...

CVE-2026-98194

In the Linux kernel, the following vulnerability has been resolved: wifi: libertastf: fix UAF in lbtffreeadapter lbtffreeadapter calls lbtffreecmdbuffer to free the command buffers before calling timerdeletesync to wait for the command timer callback. If the timer callback commandtimerfn is alrea...

CVE-2026-98195 wifi: iwlegacy: fix broadcast stations deallocation

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: fix broadcast stations deallocation On the error path of il4965up, ildeallocbcaststations clears only ILSTAUCODEACTIVE, leaving ILSTABCAST set. This causes the same broadcast stations to be deallocated again by...

CVE-2026-98194 wifi: libertas_tf: fix UAF in lbtf_free_adapter()

In the Linux kernel, the following vulnerability has been resolved: wifi: libertastf: fix UAF in lbtffreeadapter lbtffreeadapter calls lbtffreecmdbuffer to free the command buffers before calling timerdeletesync to wait for the command timer callback. If the timer callback commandtimerfn is alrea...

CVE-2026-98192

The Linux kernel contains a potential use-after-free vulnerability in the wcn36xx wifi driver during the TX ack timer teardown. The wcn36xx_dxe_deinit() function uses timer_delete(), which dequeues the timer but fails to wait for a callback already in execution. Consequently, the wcn36xx_dxe_tx_t...

CVE-2026-98192 wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...

CVE-2026-98192 wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...

EUVD-2026-93120

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...

CVE-2026-98192

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...

EUVD-2026-93108

In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msmringbuffer and struct msmgemvm embed a struct drmgpuscheduler. msmringbufferdestroy and the VM free callback msmgemvmfree call drmschedfini on the...