CVE-2026-12365

A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...

EUVD-2026-58751

A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...

CVE-2026-12365 Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race

A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...

CVE-2026-12365

A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...

CVE-2026-12365

CVE-2026-12365 describes a kernel-use-after-free in Zephyr’s second-generation work queue (kernel/work.c) related to delayable work timeouts. If a delayable work item’s timeout has been dequeued and its handler work_timeout() is in flight, a concurrent cancellation can race, allowing a freed slot...

CVE-2026-12365 Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race

A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...

PT-2026-72077

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description A use-after-free issue exists in the second-generation work queue within kernel/work.c during the handling of delayable work timeouts. The problem occurs when a delayable work item's timeout i...

CVE-2026-19293

SMP security request from peripheral does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below...

EUVD-2026-58076

SMP security request from peripheral does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below...

CVE-2026-19293 SMP security request

SMP security request from peripheral does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below...

CVE-2026-19293

The vulnerability CVE-2026-19293 concerns the BLE SMP (Security Manager Protocol) security request where the peripheral omits the maximum supported encryption key size. This omission can allow brute-forcing of the key more easily for an adjacent attacker. The entry cites the BLERP paper and provi...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Disabling MMIO access during SMU Mode 1 reset During Mode 1 reset, the ASIC undergoes a reset cycle and becomes temporarily inaccessible via PCIe. Any attempt to access MMIO registers during this period e.g., from...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: i40e: Fixed a preempt count leak in the napi poll tracepoint. Using getcpu in the tracepoint assignment causes an obvious preempt count leak, because nothing invokes putcpu to undo it. softirq: Huh, entered softirq 3 for NETRX...

The vulnerability of the smp_cmdPairingReq() function in the net/bluetooth/smp.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the smpcmdPairingReq function in the net/bluetooth/smp.c module of the Linux operating system is related to insufficient security checks for protected connections. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...

EUVD-2026-53775

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix data races on ring-ready On weakly-ordered architectures, the store to fiq-ops can be reordered past the store to ring-ready, allowing a CPU that sees ring-ready == true via fuseuringready to dispatch requests...

Linux Distros Unpatched Vulnerability : CVE-2026-64588

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fuse-uring: fix data races on ring-ready On weakly-ordered architectures, the store to fiq-ops can be reordered past the store to ring-ready, allowing a CPU tha...

CVE-2026-64588

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix data races on ring-ready On weakly-ordered architectures, the store to fiq-ops can be reordered past the store to ring-ready, allowing a CPU that sees ring-ready == true via fuseuringready to dispatch requests...

CVE-2026-10681 SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot

In Zephyr's userspace dynamic-objects subsystem, threadidxalloc in kernel/userspace/userspace.c allocated a new thread permission index from the global threadidxmap bitmap without holding listslock. On SMP systems, two user-mode threads invoking the kobjectallocKOBJTHREAD syscall concurrently can...

CVE-2026-10681

CVE-2026-10681 overview (Zephyr) : In the userspace dynamic-objects subsystem, thread_idx_alloc() reads and clears the global _thread_idx_map[] bitmap without holding lists_lock. On SMP systems, concurrent k_object_alloc(K_OBJ_THREAD) calls can observe the same free bit, perform a non-atomic RMW,...

SUSE CVE-2026-64248

In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stopthiscpu smpsendstop parks all secondary CPUs in stopthiscpu. The function marks the CPU offline for the scheduler via setcpuonlinefalse but never informs RCU, so RCU keeps expecting a...