CVE-2026-80947

A flaw was found in the Linux kernel's rtl8xxxu Wi-Fi driver. A race condition exists during the driver's stop process, specifically when handling receive RX Universal Serial Bus USB Request Blocks URBs. This allows a worker to access memory that has already been freed, leading to a use-after-fre...

CVE-2026-89508

A flaw was found in the Linux kernel's RDMA/ucma component. A race condition exists in the ucmasetibpath function when handling events concurrently with ucmamigrateid. This can allow a local attacker with access to an RDMA device to trigger a use-after-free vulnerability, potentially leading to...

CVE-2026-89766

A flaw was found in the Linux kernel. A local attacker could exploit a race condition in the pidfd subsystem, specifically within the PIDFDGETNAMESPACE ioctls. This vulnerability occurs because the system does not properly hold a lock execupdatelock during credential checks. This allows an attack...

CVE-2026-89536

A flaw was found in the Linux kernel's SUNRPC Sun Remote Procedure Call client TLS Transport Layer Security handshake process. A race condition exists where a reference to the lower transport can be prematurely released during handshake cancellation. This can lead to memory corruption, potentiall...

CVE-2026-89520

A flaw was found in the Linux kernel's core scheduling component. A race condition can occur when core scheduling flips complete during task selection, leading to incorrect lock handling. This can result in a resource leak and system instability, potentially causing a denial of service...

CVE-2026-89670

A flaw was found in the Linux kernel's Network File System Daemon nfsd component. A race condition exists in the nfsdopenlocalfh function where an nfsdfile object can be freed and its memory recycled while another process attempts to access it. This can lead to a use-after-free vulnerability,...

CVE-2026-89599

A flaw was found in the Linux kernel's fbdev: omapfb: panel-dsi-cm component. The dsicmprobe function registers a display before its associated lock mutex is properly initialized. This timing issue allows another process to attempt to acquire the uninitialized mutex, which could lead to system...

CVE-2026-89501

A flaw was found in the Linux kernel's ring-buffer component. A race condition occurs when resizing a sub-buffer without properly holding the cpubuffer::lock. This oversight can lead to concurrency issues with memory allocation and deallocation operations, potentially resulting in system...

CVE-2026-80932

A flaw was found in the Linux kernel, specifically within the vsock/virtio component. An incorrect order of flushing work items during the removal of a virtiovsock object can lead to a use-after-free condition. This vulnerability allows a race condition where memory can be freed while still in us...

CVE-2026-89675

A flaw was found in the Linux kernel's nfsd component. A race condition exists during asynchronous copy cancellation and shutdown operations, which can lead to a Use-After-Free UAF vulnerability. This allows an async copy object to be freed or used after being freed, potentially causing memory...

CVE-2026-89712

A flaw was found in the Linux kernel's Network File System Daemon NFSD component. A race condition exists where, during the processing of unmounted source-server mounts, a thread may temporarily release a lock. During this window, another NFS Remote Procedure Call RPC thread can free memory that...

CVE-2026-81001

A flaw was found in the Linux kernel's Serial Line Internet Protocol SLIP driver. A race condition in the slsync function allows for a use-after-free vulnerability, where the driver attempts to access a network device pointer after it has been freed. A local attacker could exploit this to cause a...

CVE-2026-89609

A flaw was found in the eCryptfs component of the Linux kernel. A race condition occurs during the cleanup of the daemon message queue because a required lock is not held. This can lead to unpredictable system behavior or instability due to concurrent access to shared message context lists...

CVE-2026-89461

A flaw was found in the Linux kernel's max17040 power supply driver. A timing issue, known as a race condition, can occur during system suspend. This allows a background process polling callback to continue accessing the fuel gauge and restart itself even after the system suspend has finished. Th...

CVE-2026-89763

A flaw was found in the Linux kernel's Trusted Platform Module TPM trusted keys subsystem. An incorrect teardown ordering during the exit process of trusted TPM keys can lead to a race condition. This allows a local attacker to potentially dereference a freed memory region, resulting in a...

CVE-2026-89546

A flaw was found in the Linux kernel's SUNRPC Sun Remote Procedure Call Network File System NFS callback service. A race condition during the service teardown can lead to system resources not being properly released, causing a resource leak. This issue could also result in a use-after-free...

CVE-2026-89469

A flaw was found in the Linux kernel's lp8727 power supply driver. A race condition can occur during the release of an interrupt request IRQ, where a delayed work item might be re-armed after the associated memory has been freed. This can lead to a use-after-free vulnerability, potentially causin...

CVE-2026-89771

A flaw was found in the Linux kernel. A race condition exists in the ring buffer resizing mechanism, where tracebuffer subbufsize can be read without proper locking while it is being simultaneously resized. This could allow a local attacker to trigger unpredictable behavior or a denial of service...

CVE-2026-89655

A flaw was found in the Linux kernel's Ceph file system component. A race condition exists in the kickflushingcaps function during the handling of capability messages. This allows a separate process to free a data structure cf entry while kickflushingcaps is still iterating over it. This...

CVE-2026-89540

A flaw was found in the Linux kernel's sunrpc component. A race condition exists where the gssplock mutex is not initialized before its associated /proc/net/rpc/use-gss-proxy entry is published. This allows a local attacker to trigger a scenario where multiple writers can concurrently access the...