CVE-2026-26399-Disclosure

CVE-2026-26399：ArduinoCoreSTM32（旧版本）中的基于栈的 Use-After-Return 漏洞 摘要 在 ArduinoCoreSTM32 的 1.7.0 之前的旧版本中存在一个基于栈的 use-after-return 漏洞。 该问题位于 pwmstart 实现中，其中 TIMHandleTypeDef 对象在栈上分配，其地址被传入 HAL 初始化逻辑。该指针随后可能被保留在全局定时器句柄注册表中，并在原始栈帧返回后由中断服务例程异步解引用。 该漏洞已被 MITRE 分配编号 CVE-2026-26399 。 受影响产品 产品：ArduinoCoreSTM...

CVE-2026-97600

A flaw was found in the Linux kernel's CC2520 radio driver. During device removal, an interrupt handler can queue background work after the driver's private data has been released, resulting in a use-after-free condition. A local user with privileges to disconnect or unbind the device could explo...

PT-2026-98573

In the Linux kernel, the following vulnerability has been resolved: ASoC: sti: initialize IRQ lock before requesting IRQ uni reader init registers the shared IRQ before initializing reader-irq lock. A pending interrupt can invoke the handler while the lock is still uninitialized. Initialize the...

CVE-2026-93170 dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers

In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinxdma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers Fix a race condition in AXIDMA and MCDMA irq handlers where the channel could be incorrectly marked as idle and attempt spurious...

CVE-2026-90433: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: spi: oc-tiny: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with devmrequestirq. During removal, spibitbangstop only unregisters the...

CVE-2026-90410: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: spi: davinci: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with devmrequestthreadedirq. During removal, spibitbangstop only unregisters th...

DEBIAN-CVE-2026-89797

In the Linux kernel, the following vulnerability has been resolved: power: supply: ab8500fg: fix use-after-free on remove ab8500fgremove destroys the driver workqueue while the threaded interrupt handlers are still armed; they are devm-managed and freed only after -remove returns, so a handler th...

PT-2026-93676

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A division by zero occurs in the get estimated bw function within the drm/amd/display component. This happens because the function divides by link-dpia bw alloc config.bw granularity, a...

CVE-2026-14986

The ITE it51xxx I2C driver, when operating as an I2C target slave in buffer mode CONFIGI2CTARGET + CONFIGI2CTARGETBUFFERMODE, copies host-supplied write data into the fixed-size data-targetinbuffer inside its target FIFO interrupt handler targeti2cisrfifo in drivers/i2c/i2citeit51xxx.c. The copy...

CVE-2026-14986

An out-of-bounds write in the ITE it51xxx I2C driver in Zephyr RTOS (drivers/i2c/i2c_ite_it51xxx.c) occurs when the driver operates as an I2C target in buffer mode. The FIFO interrupt handler target_i2c_isr_fifo() copies host-supplied data into a fixed 256-byte buffer but performs its bounds chec...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: comedi: A flaw in the comedibufmunge function was addressed. This function performs a modulo operation async-mungechan %= async-cmd.chanlistlen, without first checking whether chanlistlen is zero. If a user program submits a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: renesasusbhs: Fixed a use-after-free issue during the ISR Interrupt Service Routine when removing a device. In usbhsremove, the driver releases resources including the pipe array while the interrupt handler usbhsinterrupt is...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reset the IH OVERFLOWCLEAR bit. This also allows us to detect subsequent IH ring buffer overflows...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: hwmon: axi-fan-control Fixed a possible NULL pointer dereferencing issue. axifancontrolirqhandler, which depends on the private axifancontroldata structure, might be called before the hwmon device is registered. This could lead t...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: spi: spi-mt65xx: Fixed NULL pointer access in the interrupt handler. The TX buffer in spitransfer can be a NULL pointer. As a result, the interrupt handler may write to invalid memory, causing crashes. A check should be added to...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Regulator: da9211 – Use the irq handler when ready. If the system does not start from a reset state such as when it is in kexec mode, the regulator might have an IRQ waiting for processing. If we enable the IRQ handler before its...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: rkisp1: Fixed handling of IRQs due to shared interrupts. The driver requests interrupts using IRQFSHARED, so the interrupt handlers can be called at any time. If such a call occurs while the ISP is powered down, the SoC wi...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Separate handlers are used for interrupts. The interrupt vector from PF to AF, and the interrupt vector from VF to AF, both use the same interrupt handler. This causes a race condition. When two interrupts are raise...

Linux Distros Unpatched Vulnerability : CVE-2026-89440

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mmc: via-sdmmc: stop card-detect handling on probe failure requestirq registers the SD card-detect interrupt and the probe enables it before mmcaddhost runs. If...

Linux Distros Unpatched Vulnerability : CVE-2026-80950

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct...