CVE-2026-89441 mmc: via-sdmmc: cancel card-detect work on remove

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddetwork already queued by the handler can still run after viasdremove...

EUVD-2026-76347

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddetwork already queued by the handler can still run after viasdremove...

CVE-2026-89441

CVE-2026-89441 is a use-after-free vulnerability in the Linux kernel's mmc: via-sdmmc driver. During device removal, a previously queued carddet_work can still execute after via_sd_remove() returns, dereferencing the freed host's MMIO base via container_of(). This can lead to system instability o...

CVE-2026-89441 mmc: via-sdmmc: cancel card-detect work on remove

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddetwork already queued by the handler can still run after viasdremove...

CVE-2026-89438

This CVE affects the Linux kernel 's platform/x86: ISST (Intelligent Speed and Frequency Tuning Technology) driver. The root cause is a missing validation of the maximum CLOS ID and logical CPU ID for the core power feature. These values are used to calculate MMIO offsets , so an out-of-range val...

CVE-2026-89438 platform/x86: ISST: Validate logical CPU id and clos id

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

CVE-2026-89438

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

EUVD-2026-76344

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

CVE-2026-89438 platform/x86: ISST: Validate logical CPU id and clos id

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

CVE-2026-80939 wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot Since the hardware rfkill polling was introduced, arm64 platforms can panic with an asynchronous SError during warm reboot: SError Interrupt on CPU8, code...

CVE-2026-80939

CVE-2026-80939 affects the Linux kernel rtw89 PCI WiFi driver on arm64 platforms. The root cause is a missing .shutdown callback: during warm reboot the kernel invokes device_shutdown() but not .remove(), so the rfkill polling workqueue continues issuing MMIO reads to the PCI device after the PCI...

PT-2026-90312

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nv suspend and nv resume walk the non-PCI configuration space with for i = 0; i register size/sizeofu32; i++ which runs one iteration too many. saved config spa...

PT-2026-90154

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

PT-2026-90157

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddet work already queued by the handler can still run after via sd remov...

kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses

A flaw was found in the Linux kernel. The mt7925 Wi-Fi driver incorrectly dispatches a memory-mapped I/O MMIO specific event to non-MMIO buses, such as USB. This improper handling leads to a NULL pointer dereference when attempting to clean up DMA transmit queues. A remote attacker could exploit...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053262)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053262 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use scratch field in MMIO fragment to hold small write values When exiting to userspace...

AZL-99639 CVE-2026-80861 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: bail out of setup if the controller is inaccessible xhcigensetup locates the operational registers using the capability length read from the very first register: xhci-opregs = hcd-regs +...

CVE-2026-80861

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: bail out of setup if the controller is inaccessible xhcigensetup locates the operational registers using the capability length read from the very first register: xhci-opregs = hcd-regs +...

CVE-2026-80861 usb: xhci: bail out of setup if the controller is inaccessible

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: bail out of setup if the controller is inaccessible xhcigensetup locates the operational registers using the capability length read from the very first register: xhci-opregs = hcd-regs +...

CVE-2026-80861 usb: xhci: bail out of setup if the controller is inaccessible

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: bail out of setup if the controller is inaccessible xhcigensetup locates the operational registers using the capability length read from the very first register: xhci-opregs = hcd-regs +...