CVE-2026-89440

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: stop card-detect handling on probe failure requestirq registers the SD card-detect interrupt and the probe enables it before mmcaddhost runs. If mmcaddhost fails, the error path only unmaps the registers and...

CVE-2026-80950

In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesasi3cxfer, enqueues it, and waits for completion. The interrupt...

CVE-2026-89440

CVE-2026-89440 is a use-after-free vulnerability in the Linux kernel's via-sdmmc MMC driver. During device probe, the SD card-detect interrupt is registered before mmc_add_host() runs. If that call fails, the error path only unmaps registers and returns, leaving the interrupt registered. The hand...

EUVD-2026-76346

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: stop card-detect handling on probe failure requestirq registers the SD card-detect interrupt and the probe enables it before mmcaddhost runs. If mmcaddhost fails, the error path only unmaps the registers and...

EUVD-2026-76314

In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravbptpinterrupt can race with ravbptpstop and pass the clock to ptpclockevent while ptpclockunregister is freeing it. This can lead to a use-after-free. Use READONCE and WRITEONCE for...

CVE-2026-80991

CVE-2026-80991 affects the Linux kernel 's ravb network driver. A race condition exists between ravb_ptp_interrupt() and ravb_ptp_stop(): the interrupt handler can pass the PTP clock to ptp_clock_event() while ptp_clock_unregister() is concurrently freeing it, resulting in a use-after-free . The ...

CVE-2026-80950 i3c: renesas: Check that the transfer is valid before accessing it

In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesasi3cxfer, enqueues it, and waits for completion. The interrupt...

EUVD-2026-76273

In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesasi3cxfer, enqueues it, and waits for completion. The interrupt...

CVE-2026-80950 i3c: renesas: Check that the transfer is valid before accessing it

In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesasi3cxfer, enqueues it, and waits for completion. The interrupt...

CVE-2026-80930 tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout

In the Linux kernel, the following vulnerability has been resolved: tpm: tpmi2cnuvoton: disable IRQ on wait timeout i2cnuvotonwaitforstat enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the...

PT-2026-90080

In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesas i3c xfer, enqueues it, and waits for completion. The interrupt...

CVE-2026-26399-Disclosure

CVE-2026-26399：ArduinoCoreSTM32（旧版本）中的基于栈的 Use-After-Return 漏洞 摘要 在 ArduinoCoreSTM32 的 1.7.0 之前的旧版本中存在一个基于栈的 use-after-return 漏洞。 该问题位于 pwmstart 实现中，其中 TIMHandleTypeDef 对象在栈上分配，其地址被传入 HAL 初始化逻辑。该指针随后可能被保留在全局定时器句柄注册表中，并在原始栈帧返回后由中断服务例程异步解引用。 该漏洞已被 MITRE 分配编号 CVE-2026-26399 。 受影响产品 产品：ArduinoCoreSTM...

CVE-2026-80678

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2cimxregslave, the slave pointer was assigned before pmruntimeresumeandget. If pmruntimeresumeandget failed, the error path returned without clearing i2cimx-slave,...

UBUNTU-CVE-2026-80678

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2cimxregslave, the slave pointer was assigned before pmruntimeresumeandget. If pmruntimeresumeandget failed, the error path returned without clearing i2cimx-slave,...

CVE-2026-80694

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: pass eth to mtkhandleirqrx in pollcontroller mtkhandleirqrx expects a struct mtketh matching the requestirq cookie, but mtkpollcontroller incorrectly passed the netdevice . Calling ndopollcontroller with...

CVE-2026-80678 i2c: imx: Fix slave registration race and error handling

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2cimxregslave, the slave pointer was assigned before pmruntimeresumeandget. If pmruntimeresumeandget failed, the error path returned without clearing i2cimx-slave,...

CVE-2026-80614 net: emac: Fix NULL pointer dereference in emac_probe

In the Linux kernel, the following vulnerability has been resolved: net: emac: Fix NULL pointer dereference in emacprobe Move devmrequestirq after devmplatformioremapresource so that dev-emacp is mapped before the interrupt handler can fire. An early interrupt hitting emacirq would dereference th...

CVE-2026-80614

This vulnerability affects the Linux kernel 's emac network driver (ethernet MAC). During emac_probe, the call to devm_request_irq() was made before devm_platform_ioremap_resource() , leaving dev->emacp unmapped (NULL). If an early interrupt fired before the mapping completed, the handler emac...

CVE-2026-74629

A flaw was found in the Linux kernel's dibs device handling. A use-after-free UAF vulnerability exists where a dibs device interrupt handler can access dmbclientidarr after it has been freed. Additionally, a double-free vulnerability can occur if dibsdevadd fails during dibslodevprobe, leading to...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: spi: spi-mt65xx: Fixed NULL pointer access in the interrupt handler. The TX buffer in spitransfer can be a NULL pointer. As a result, the interrupt handler may write to invalid memory, causing crashes. Add a check for trans-txbuf...