CVE-2026-64093

The CVE concerns batman-adv (Linux kernel) where tp_meter cleanup caused a potential re-arm of a timer due to two-step deletion. batadv_tp_sender_cleanup() called timer_delete_sync() followed by timer_delete(); the fix replaces both calls with a single timer_shutdown_sync() that waits for any run...

CVE-2026-64093 batman-adv: tp_meter: directly shut down timer on cleanup

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: directly shut down timer on cleanup batadvtpsendercleanup was calling timerdeletesync followed by timerdelete to guard against the timer handler re-arming itself between the two calls. This double-deletion ha...

CVE-2026-64093 batman-adv: tp_meter: directly shut down timer on cleanup

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: directly shut down timer on cleanup batadvtpsendercleanup was calling timerdeletesync followed by timerdelete to guard against the timer handler re-arming itself between the two calls. This double-deletion ha...

CVE-2026-64092 batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: fix tpvars reference leak in receiver shutdown The receiver shutdown timer handler, batadvtpreceivershutdown, is responsible for releasing the tpvars reference it holds. However, the existing logic for...

CVE-2026-64092

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: fix tpvars reference leak in receiver shutdown The receiver shutdown timer handler, batadvtpreceivershutdown, is responsible for releasing the tpvars reference it holds. However, the existing logic for...

CVE-2026-64092 batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: fix tpvars reference leak in receiver shutdown The receiver shutdown timer handler, batadvtpreceivershutdown, is responsible for releasing the tpvars reference it holds. However, the existing logic for...

EUVD-2026-45777

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: fix tpvars reference leak in receiver shutdown The receiver shutdown timer handler, batadvtpreceivershutdown, is responsible for releasing the tpvars reference it holds. However, the existing logic for...

CVE-2026-64092

Technical details about CVE-2026-64092 are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2026-64092

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: fix tpvars reference leak in receiver shutdown The receiver shutdown timer handler, batadvtpreceivershutdown, is responsible for releasing the tpvars reference it holds. However, the existing logic for...

CVE-2026-64038

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Stop work before releasing hwmon device Sashiko reports: In lm90probe, the devm action to cancel the alertwork and reportwork lm90restoreconf is registered in lm90initclient before devmhwmondeviceregisterwithinfo is...

CVE-2026-64038 hwmon: (lm90) Stop work before releasing hwmon device

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Stop work before releasing hwmon device Sashiko reports: In lm90probe, the devm action to cancel the alertwork and reportwork lm90restoreconf is registered in lm90initclient before devmhwmondeviceregisterwithinfo is...

EUVD-2026-45611

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Stop work before releasing hwmon device Sashiko reports: In lm90probe, the devm action to cancel the alertwork and reportwork lm90restoreconf is registered in lm90initclient before devmhwmondeviceregisterwithinfo is...

CVE-2026-64038 hwmon: (lm90) Stop work before releasing hwmon device

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Stop work before releasing hwmon device Sashiko reports: In lm90probe, the devm action to cancel the alertwork and reportwork lm90restoreconf is registered in lm90initclient before devmhwmondeviceregisterwithinfo is...

CVE-2026-64038

CVE-2026-64038 concerns the Linux kernel hwmon lm90 driver. In lm90_probe(), devm actions to cancel alert_work and report_work were registered before hwmon device registration. With devm cleanup in reverse order, the hwmon device could be freed first, allowing lm90_update_alarms() to dereference ...

CVE-2026-63803

In the Linux kernel, the following vulnerability has been resolved: hdlcppp: sync per-proto timers before freeing hdlc state Each PPP control protocol LCP/IPCP/IPV6CP embedded in struct ppp registers a timer via timersetup. That struct ppp is the hdlc-state allocation, which detachhdlcprotocol...

CVE-2026-63803 hdlc_ppp: sync per-proto timers before freeing hdlc state

In the Linux kernel, the following vulnerability has been resolved: hdlcppp: sync per-proto timers before freeing hdlc state Each PPP control protocol LCP/IPCP/IPV6CP embedded in struct ppp registers a timer via timersetup. That struct ppp is the hdlc-state allocation, which detachhdlcprotocol...

CVE-2026-63803

The CVE-2026-63803 has concrete technical details in the Linux kernel: hdlc_ppp timers for PPP LCP/IPCP/IPV6CP in struct ppp are not synchronized on teardown due to a missing .detach callback, causing a use-after-free when a ppp_timer dereferences freed memory. The fix adds a detach helper that c...

CVE-2026-63803 hdlc_ppp: sync per-proto timers before freeing hdlc state

In the Linux kernel, the following vulnerability has been resolved: hdlcppp: sync per-proto timers before freeing hdlc state Each PPP control protocol LCP/IPCP/IPV6CP embedded in struct ppp registers a timer via timersetup. That struct ppp is the hdlc-state allocation, which detachhdlcprotocol...

PT-2026-61410

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the batman-adv module within the tp meter component. The batadv tp sender cleanup function previously used a combination of timer delete sync and timer delete to preve...

PT-2026-61409

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp meter: fix tp vars reference leak in receiver shutdown The receiver shutdown timer handler, batadv tp receiver shutdown, is responsible for releasing the tp vars reference it holds. However, the existing logic for...