EUVD-2026-76675

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trustedtpmexit drops the TPM chip reference and frees the digest array before unregistering the trusted key type. keytypelookup holds keytypessem for reading until the key operation...

CVE-2026-89763

CVE-2026-89763 is a use-after-free vulnerability in the Linux kernel's TPM trusted keys subsystem. An incorrect teardown ordering in trusted_tpm_exit() releases the TPM chip reference and frees the digest array before unregistering the trusted key type, creating a race condition that allows anoth...

CVE-2026-89763

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trustedtpmexit drops the TPM chip reference and frees the digest array before unregistering the trusted key type. keytypelookup holds keytypessem for reading until the key operation...

CVE-2026-89668 nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

CVE-2026-89668

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

CVE-2026-89535

CVE-2026-89535 is a use-after-free vulnerability in the Linux kernel's svcrdma module, caused by an incorrect ordering of operations during RDMA transport teardown. Specifically, rpcrdma_rn_unregister() was called after rdma_destroy_id(), leaving the transport's notification entry installed in th...

EUVD-2026-76424

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix thisrq assumptions in dispatch kfuncs Under core scheduling, dispatch runs from within the core-wide pick and can target a sibling rq, so ops.dispatch may execute on a CPU different from the dispatched rq's. Several...

CVE-2026-89474 power: supply: bq256xx: drain usb_work before freeing the charger

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq256xx: drain usbwork before freeing the charger The USB-PHY notifier queues usbwork, whose handler calls powersupplychangedbq-charger. The reset devm action only unregisters the notifier and was registered before...

CVE-2026-89472

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: register regulators before exposing sysfs chargermanagerremove and the errregextcon probe error path free each charger regulator with regulatorput before tearing down the powersupply sysfs entries...

CVE-2026-89468

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8788-charger: fix use-after-free on remove lp8788chargerremove flushes chargerwork before unregistering the IRQs. An IRQ thread can queue chargerwork after flushwork has returned. The work can then run after devr...

CVE-2026-89447 iommufd: Avoid locking internal accesses during unmap

In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufdaccessnotifyunmap skips internal accesses because they do not have an external unmap callback to invoke. However, the current test calls iommufdlockobj before checking...

CVE-2026-80953

CVE-2026-80953 is a race condition in the Linux kernel's ADI i3c master driver . The function adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before the controller's transfer queue lock (xferqueue.lock) and IBI state are initialized. A pending CMDR interrupt can therefore...

EUVD-2026-76276

In the Linux kernel, the following vulnerability has been resolved: i3c: master: adi: initialize the lock before enabling interrupts adii3cmasterprobe requests the IRQ and unmasks REGIRQPENDINGCMDR before the controller's IBI state, transfer queue list and transfer queue lock are initialized. A...

CVE-2026-80953 i3c: master: adi: initialize the lock before enabling interrupts

In the Linux kernel, the following vulnerability has been resolved: i3c: master: adi: initialize the lock before enabling interrupts adii3cmasterprobe requests the IRQ and unmasks REGIRQPENDINGCMDR before the controller's IBI state, transfer queue list and transfer queue lock are initialized. A...

PT-2026-90473

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sort folio function within the multi-generational least recently used MGLRU mechanism. The function contains a buggy shortcut for handling folios that are no longe...

PYSEC-2026-3922 SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

Summary ModelView.sortquery uses the attacker-controlled sortBy list-view query parameter without checking it against the configured columnsortablelist allow-list. The value is resolved with getattrmodel, ... and fed into relationship joins and orderby, so a request can sort by any column of the...

EUVD-2026-75218

Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering siam-server 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrator...

CVE-2026-71809

Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering siam-server 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrator...

CVE-2026-71808

A SQL Injection vulnerability in Siam Ordering siam-server 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the $ string concatenation in AdminMapper.java and multiple other Mapper files including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.ja...

SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

Summary ModelView.sortquery uses the attacker-controlled sortBy list-view query parameter without checking it against the configured columnsortablelist allow-list. The value is resolved with getattrmodel, ... and fed into relationship joins and orderby, so a request can sort by any column of the...