PT-2026-136091

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the io uring/io-wq component where a linked request can become temporarily invisible during the cancellation process when a task exits. Specifically, within th...

PT-2026-136098

In the Linux kernel, the following vulnerability has been resolved: io uring/timeout: don't lose a cancel as io-wq arms a timeout An IORING OP TIMEOUT run by io-wq, because of IOSQE ASYNC, has the same problem as poll, futex and waitid. io wq submit work looks at IO WQ WORK CANCEL once, before it...

PT-2026-136090

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the io uring subsystem where the io ring exit work function repeatedly queues callbacks to tasks using the ring to remove their tctx nodes. When a task is in io uring...

PT-2026-136104

In the Linux kernel, the following vulnerability has been resolved: io uring: wake ring pollers for local task work With IORING SETUP DEFER TASKRUN completions are queued as local work, and only become CQEs when the submitter enters the kernel to wait for events. For an application that finds out...

PT-2026-136103

In the Linux kernel, the following vulnerability has been resolved: io uring/napi: make stale entries time out after 60s With dynamic tracking a NAPI id that hasn't been seen for a minute is meant to be dropped from the list the ring busy polls. The timeout is added to jiffies, but it is defined ...

PT-2026-122019

In the Linux kernel, the following vulnerability has been resolved: io uring/net: populate CONNECT filter fields for 24-byte sockaddr in6 io connect bpf populate fills connect.port and connect.v6 addr for AF INET6 only when addr len = sizeofstruct sockaddr in6, i.e. 28 bytes. The IPv6 connect pat...

PT-2026-121933

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the btrfs component where the btrfs uring read extent function fails to properly release locks. The function operates after btrfs encoded read has acquired the inode...

CLSA-2026-1775655705 kernel-uek: Fix of 34 CVEs

ALSA: usb-audio: Fix use-after-free in sndusbmixerfree CVE-2026-23089 - HID: core: Harden s32ton against conversion to 0 bits CVE-2025-38556 - KVM: nSVM: Ignore nCR34:0 when loading PDPTEs from memory CVE-2024-50115 - KVM: x86: Reset IRTE to host control if new route isn't postable CVE-2025-37885...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: media: dvb-core: fix wrong reinitialization of ringbuffer on reopen dvbdvropen calls dvbringbufferinit when a new reader opens the DVR device. dvbringbufferinit calls initwaitqueuehead, which reinitializes the waitqueue list head...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/aio: Restricted kiocbsetcancelfn to I/O submitted via libaio. If kiocbsetcancelfn is called for I/O submitted via iouring, the following kernel warning appears: WARNING: CPU: 3 PID: 368 at fs/aio.c:598 kiocbsetcancelfn+0x9c/0x...

SUSE CVE-2026-90095

In the Linux kernel, the following vulnerability has been resolved: fuse: Fix the condition to enable over-io-uring The existing condition in fuseuringcmd is there only to avoid disabling io-uring for connections that already run with it, missing was a condition to refuse any IORINGOPURINGCMD if...

DEBIAN-CVE-2026-90095

In the Linux kernel, the following vulnerability has been resolved: fuse: Fix the condition to enable over-io-uring The existing condition in fuseuringcmd is there only to avoid disabling io-uring for connections that already run with it, missing was a condition to refuse any IORINGOPURINGCMD if...

EUVD-2026-81956

In the Linux kernel, the following vulnerability has been resolved: fuse: Fix the condition to enable over-io-uring The existing condition in fuseuringcmd is there only to avoid disabling io-uring for connections that already run with it, missing was a condition to refuse any IORINGOPURINGCMD if...

CVE-2026-90095

CVE-2026-90095 affects the Linux kernel FUSE subsystem. The root cause is a missing condition in fuse_uring_cmd() that failed to refuse IORING_OP_URING_CMD when the FUSE_OVER_IO_URING flag was absent from the FUSE_INIT reply. Without this guard, the barrier in fuse_uring_ready() does not function...

CVE-2026-90095: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fuse: Fix the condition to enable over-io-uring The existing condition in fuseuringcmd is there only to avoid disabling io-uring for connections that already run with it, missing was a condition to refuse any IORINGOPURINGCMD if...

PT-2026-94399

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the TCP implementation where devmem TX is not properly enforced to require zero-copy when NETIF F SG is absent. In such scenarios, the tcp sendmsg locked function...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nullblk: fixed handling of poll request timeouts When performing the iouring benchmark on /dev/nullb0, it’s easy for the kernel to crash if poll requests time out, as reported by David. 1 BUG: Kernel NULL pointer dereferencing...

Astra Linux – Vulnerability in Linux 5.10

There is a vulnerability related to time-of-check to time-of-use issues in the iouringsubsystem’s IORINGOPCLOSE operation in the Linux kernel versions 5.6 to 5.11 inclusive. This vulnerability allows a local user to elevate their privileges to root. Introduced in the version...

SUSE CVE-2026-80946

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

Linux Distros Unpatched Vulnerability : CVE-2026-80946

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copie...