CVE-2026-74652

A use-after-free vulnerability in the Linux kernel's amba-pl011 serial driver affects the RS485 trigger high-resolution timers (hrtimers). These timers are embedded in the devm-managed port and can fire after the port is freed, because the IRQ handler may arm a timer before the timers are cancele...

PT-2026-79657

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...

UBUNTU-CVE-2026-72424

In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313rtcprobe calls devmrequestirq with IRQFSHARED and &pdev-dev as the cookie, but platformsetdrvdata is only called later after the clock setup. With a shared IRQ line...

UBUNTU-CVE-2026-72454

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3chciaddrtodev i3chciaddrtodev walks bus-devs.i3c, which is protected by bus.lock rwsem. However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows concurrent...

CVE-2026-72454

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3chciaddrtodev i3chciaddrtodev walks bus-devs.i3c, which is protected by bus.lock rwsem. However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows concurrent...

CVE-2026-72454

The CVE-2026-72454 issue affects the Linux kernel i3c/mipi-i3c-hci path. A race in i3c_hci_addr_to_dev() occurs because it traverses bus->devs.i3c (protected by bus.lock) while the IRQ handler cannot take the lock, risking use-after-free or crashes during concurrent device add/remove. The fix ...

EUVD-2026-59353

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3chciaddrtodev i3chciaddrtodev walks bus-devs.i3c, which is protected by bus.lock rwsem. However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows concurrent...

CVE-2026-72454 i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3chciaddrtodev i3chciaddrtodev walks bus-devs.i3c, which is protected by bus.lock rwsem. However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows concurrent...

CVE-2026-72454 i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3chciaddrtodev i3chciaddrtodev walks bus-devs.i3c, which is protected by bus.lock rwsem. However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows concurrent...

CVE-2026-72424

CVE-2026-72424 concerns the Linux kernel RTC MSC313 driver. The vulnerability arises when msc313_rtc_probe() calls devm_request_irq() with IRQF_SHARED and the cookie set to &pdev->dev, while platform_set_drvdata() runs later after clock setup. Under a shared IRQ line, another device can fire t...

CVE-2026-72424 rtc: msc313: fix NULL deref in shared IRQ handler at probe

In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313rtcprobe calls devmrequestirq with IRQFSHARED and &pdev-dev as the cookie, but platformsetdrvdata is only called later after the clock setup. With a shared IRQ line...

PT-2026-72329

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 IRQ SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next...

PT-2026-72612

In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313 rtc probe calls devm request irq with IRQF SHARED and &pdev-dev as the cookie, but platform set drvdata is only called later after the clock setup. With a shared I...

PT-2026-72642

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3c hci addr to dev i3c hci addr to dev walks bus-devs.i3c, which is protected by bus.lock rwsem. However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows...

Linux Distros Unpatched Vulnerability : CVE-2026-72454

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i3c: mipi-i3c-hci: Fix race in i3chciaddrtodev i3chciaddrtodev walks bus-devs.i3c, which is protected by bus.lock rwsem. However, it is invoked from the MIPI I3...

CVE-2026-68395 ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered

In the Linux kernel, the following vulnerability has been resolved: ata: satadwc460ex: enable SATA interrupts only after IRQ handler is registered satadwcenableinterrupts is called before platformgetirq and atahostactivate, leaving the SATA controller's interrupt mask enabled without a registered...

CVE-2026-64587

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: arc: emac: quiesce interrupts before requesting IRQ Normal RX/TX interrupts are enabled later, in arcemacopen, so probe should not see interrupt delivery in the usual case. However, hardware may still present stale...

PT-2026-68416

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Broadcom BDC UDC driver contains a race condition during the removal process. The driver uses devm request irq in the bdc udc init function, which means the interrupt request IRQ is...

CVE-2026-64583

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: bdc: free IRQ and drain funcwakenotify before teardown The Broadcom BDC UDC driver registers its IRQ handler with devmrequestirq in bdcudcinit, so the IRQ is released by devm only after bdcremove returns. devm...

CVE-2026-64329

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove The threaded IRQ handler ccgirqhandler calls ucsinotifycommon, which on a connector-change event calls ucsiconnectorchange and schedules connector work. In ucsiccgremove...