CVE-2026-93184

CVE-2026-93184 affects the Linux kernel ASoC fsl_audmix driver's runtime PM handling during probe. After pm_runtime_enable(), the AUDMIX audio mixer block remains powered off until the first runtime resume. Register writes issued between probe() and that first resume—originating from DAPM or ALSA...

EUVD-2026-82292

In the Linux kernel, the following vulnerability has been resolved: ASoC: fslaudmix: rework runtime PM handling in probe After pmruntimeenable the AUDMIX block is powered off and stays suspended until the first runtime resume. Register writes issued between probe and the first resume e.g. from DA...

CVE-2026-93169

CVE-2026-93169 is a race condition in the Linux kernel's zynqmp_dma DMA engine driver (Zynq MP platform). In the zynqmp_dma_remove() function, runtime PM was disabled only after checking device state and performing a manual suspend. This ordering could race with runtime PM activity during the mod...

EUVD-2026-82277

In the Linux kernel, the following vulnerability has been resolved: dmaengine: zynqmpdma: fix race between runtime PM and device removal In zynqmpdmaremove, runtime PM was disabled only after checking state and doing a manual suspend. This can race with runtime PM in the remove/unbind rmmod path...

CVE-2026-90406

CVE-2026-90406 affects the Linux kernel 's qcom iris media driver . The vulnerability resides in iris_core_deinit(), where the return value of pm_runtime_resume_and_get() was not checked. If the runtime PM resume fails, the driver would proceed with hardware power-off operations and call pm_runti...

EUVD-2026-81842

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes The IIO core does not filter duplicate writes to the event enable attribute, so writing the same value twice invokes writeeventconfig twice. Enabling twice...

CVE-2026-90249

This Linux kernel vulnerability affects the gp2ap002 IIO light/proximity sensor driver. The root cause is that the IIO core does not filter duplicate writes to the event enable attribute, causing write_event_config() to be invoked twice. Enabling an event twice leaks a runtime PM reference, preve...

EUVD-2026-80539

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable atlasbufferpostenable acquires a runtime PM reference with pmruntimeresumeandget but returns the result of atlassetinterrupt directly. If atlassetinterrupt...

EUVD-2026-80535

In the Linux kernel, the following vulnerability has been resolved: iio: light: apds9306: fix PM reference leak in apds9306readdata apds9306readdata calls pmruntimeresumeandget but several error paths return directly without calling pmruntimeputautosuspend, leaking the runtime PM reference and...

CVE-2026-89934

CVE-2026-89934 is a runtime PM (Power Management) reference leak in the Linux kernel's LTRF216A light sensor driver (IIO subsystem). The function ltrf216a_get_lux() acquires a runtime PM reference via ltrf216a_set_power_state(data, true), but when ltrf216a_read_data() fails, it returns without re...

CVE-2026-89935

CVE-2026-89935 affects the Linux kernel iio: light: apds9306 driver (APDS9306 ambient light sensor). The root cause is a runtime PM reference leak : apds9306_read_data() calls pm_runtime_resume_and_get() but several error paths return without the matching pm_runtime_put_autosuspend(), preventing ...

EUVD-2026-80489

In the Linux kernel, the following vulnerability has been resolved: media: i2c: imx415: Release runtime PM reference on VBLANK error The VBLANK path returned immediately when programming VMAX failed after pmruntimegetifinuse had taken a runtime PM reference. Break out of the switch instead so the...

CVE-2026-89889

CVE-2026-89889 is a bug in the Linux kernel's imx415 I2C media (camera sensor) driver. In the VBLANK handling path, when programming VMAX failed after pm_runtime_get_if_in_use() had taken a runtime PM reference , the code returned immediately without calling pm_runtime_put(), leaking the referenc...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: i2c: imx-lpi2c: fixed a reference leak when pmruntimegetsync fails. The PM reference count is not expected to be incremented on the return in lpi2cimxmasterenable. However, pmruntimegetsync will still increment the PM reference...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: lvds: fix PM usage counter unbalance in poweron The pmruntimegetsync function will increment the PM usage counter even if it fails. Forgetting to replace this function with the newer pmruntimeresumeandget function...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: soc: brcmstb: pm-arm: Fixed bugs related to reference count leaks and iomem leaks. In brcmstbpmprobe, there are two types of leak bugs: 1 We need to add ofnodeput when foreachmatchingnode breaks. 2 We need to call iounmap for...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: clk: ti: dra7-atl: Fixed a reference leak in ofdra7atlclkprobe. pmruntimegetsync will increment the pm usage counter. Forgetting to perform the necessary operations will result in a reference leak. Added the missing...

Astra Linux – Vulnerability in CGal

There are multiple code execution vulnerabilities in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted, malformed file can lead to an out-of-bounds read and type confusion, which may result in code execution. An attacker can provide malicious input to trigger a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: PM: runtime: Fixed a race condition related to device removal The following code in pmruntimework may cause dereferencing of the dev-parent pointer after the parent device has been freed: c / Maybe the parent is now able to...

Linux Distros Unpatched Vulnerability : CVE-2026-89590

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths...