SUSE CVE-2026-90394

In the Linux kernel, the following vulnerability has been resolved: power: supply: sc2731charger: cancel work on remove The USB notifier and initial charger detection can schedule info-work. The remove path unregisters the notifier, but does not cancel queued or running work before the...

Linux Distros Unpatched Vulnerability : CVE-2026-90395

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - power: supply: isp1704charger: cancel work on remove The USB notifier and initial VBUS detection can schedule isp-work. The remove path unregisters the notifier...

Security Bulletin: Spring Framework (spring-expression) — Denial of Service via SpEL Power Operator

Summary spring-expression-6.2.19.jar detected by Mend scanner in db2-service-java/pom.xml. The affected version 6.2.19 is vulnerable to CVE-2026-47886 where applications evaluating user-supplied Spring Expression Language SpEL expressions using the power operator ^ with a BigDecimal or BigInteger...

CVE-2026-90395

In the Linux kernel, the following vulnerability has been resolved: power: supply: isp1704charger: cancel work on remove The USB notifier and initial VBUS detection can schedule isp-work. The remove path unregisters the notifier and power supply, but does not wait for queued or running work befor...

DEBIAN-CVE-2026-90362

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: Drop devpmoppsetrate0 devpmoppsetrate0 removes the vote specified in required-opps but does not actually park the clock, making it run without the necessary power backing. Drop the explicit call to it. Every call sit...

DEBIAN-CVE-2026-90187

In the Linux kernel, the following vulnerability has been resolved: nullblk: free zones array on device power-off nullinitzoneddev allocates dev-zones when a zoned device is powered on, but nulldeldev never frees it on power-off; dev-zones is only freed later in nullfreedev, when the configfs...

CVE-2026-90187

In the Linux kernel, the following vulnerability has been resolved: nullblk: free zones array on device power-off nullinitzoneddev allocates dev-zones when a zoned device is powered on, but nulldeldev never frees it on power-off; dev-zones is only freed later in nullfreedev, when the configfs...

AZL-102177 CVE-2026-90187 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nullblk: free zones array on device power-off nullinitzoneddev allocates dev-zones when a zoned device is powered on, but nulldeldev never frees it on power-off; dev-zones is only freed later in nullfreedev, when the configfs...

DEBIAN-CVE-2026-90136

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/hsmp: Reject negative power cap writes in hwmon hsmphwmonwrite takes the user-supplied hwmon value as a signed long and assigns "val / MICROWATTPERMILLIWATT" to msg.args0, which is a u32. MICROWATTPERMILLIWATT is...

SUSE CVE-2026-89797

In the Linux kernel, the following vulnerability has been resolved: power: supply: ab8500fg: fix use-after-free on remove ab8500fgremove destroys the driver workqueue while the threaded interrupt handlers are still armed; they are devm-managed and freed only after -remove returns, so a handler th...

SUSE CVE-2026-89869

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: use disableirq during power-off The IRQ is registered as a threaded IRQ. Using disableirqnosync in irisvpupoweroff does not wait for an already queued threaded IRQ handler to complete before returning. As a...

EUVD-2026-82055

In the Linux kernel, the following vulnerability has been resolved: power: supply: sc2731charger: cancel work on remove The USB notifier and initial charger detection can schedule info-work. The remove path unregisters the notifier, but does not cancel queued or running work before the...

CVE-2026-90395 power: supply: isp1704_charger: cancel work on remove

In the Linux kernel, the following vulnerability has been resolved: power: supply: isp1704charger: cancel work on remove The USB notifier and initial VBUS detection can schedule isp-work. The remove path unregisters the notifier and power supply, but does not wait for queued or running work befor...

CVE-2026-90362 drm/msm/dsi: Drop dev_pm_opp_set_rate(0)

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: Drop devpmoppsetrate0 devpmoppsetrate0 removes the vote specified in required-opps but does not actually park the clock, making it run without the necessary power backing. Drop the explicit call to it. Every call sit...

EUVD-2026-82023

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: Drop devpmoppsetrate0 devpmoppsetrate0 removes the vote specified in required-opps but does not actually park the clock, making it run without the necessary power backing. Drop the explicit call to it. Every call sit...

CVE-2026-90362

CVE-2026-90362 affects the Linux kernel 's drm/msm/dsi driver (Qualcomm Display Serial Interface). The root cause is an explicit call to dev_pm_opp_set_rate(0) , which removes the operating performance point vote specified in required-opps but does not actually park the clock, leaving it running ...

CVE-2026-90362 drm/msm/dsi: Drop dev_pm_opp_set_rate(0)

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: Drop devpmoppsetrate0 devpmoppsetrate0 removes the vote specified in required-opps but does not actually park the clock, making it run without the necessary power backing. Drop the explicit call to it. Every call sit...

CVE-2026-90187

This vulnerability affects the null_blk (null block) driver in the Linux kernel . The root cause is a memory leak in zoned device handling: null_init_zoned_dev() allocates the dev->zones array on power-on, but null_del_dev() does not free it on power-off. Each subsequent power cycle overwrites...

EUVD-2026-81780

In the Linux kernel, the following vulnerability has been resolved: nullblk: free zones array on device power-off nullinitzoneddev allocates dev-zones when a zoned device is powered on, but nulldeldev never frees it on power-off; dev-zones is only freed later in nullfreedev, when the configfs...

CVE-2026-90187 null_blk: free zones array on device power-off

In the Linux kernel, the following vulnerability has been resolved: nullblk: free zones array on device power-off nullinitzoneddev allocates dev-zones when a zoned device is powered on, but nulldeldev never frees it on power-off; dev-zones is only freed later in nullfreedev, when the configfs...