Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix cs84xx use-after-free on host teardown qla84xxputchip drops the last reference to ha-cs84xx and frees it via qla84xxchiprelease without clearing ha-cs84xx. During teardown, it was executed before scsiremovehost...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Only report alarms if the driver is ready Userspace can read sysfs attributes before driver registration is complete, immediately after devmhwmondeviceregisterwithinfo has been called. At that time, data-hwmondev is n...

CVE-2026-93200

A flaw was found in the Linux kernel's i3c master driver. This use-after-free vulnerability occurs because sysfs attribute callbacks can attempt to access memory that has already been deallocated. An attacker could potentially exploit this to cause system instability or a denial of service...

PT-2026-94984

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the kone keep values up to date and kone profile activated functions use an 8-bit profile value supplied by a device as an index for the 5-element kone-profiles arr...

CVE-2026-89854

CVE-2026-89854 is a use-after-free in the Linux kernel's qla2xxx SCSI driver . During host teardown, qla84xx_put_chip() frees the ha->cs84xx chip structure without clearing the pointer, and it runs before scsi_remove_host() removes the 84xx_fw_version sysfs attribute. A concurrent read of that...

CVE-2026-89472

A flaw was found in the Linux kernel's power supply charger-manager component. A race condition exists where the system frees charger regulators before their corresponding sysfs entries are unregistered. A local attacker can exploit this by performing a concurrent write to a charger's...

CVE-2026-81006

A flaw was found in the Linux kernel's Intelligent Platform Management Interface IPMI component. During the registration of an IPMI system management interface, an error in the cleanup process can leave a system file sysfs attribute registered even after its associated memory has been released...

CVE-2026-89472

CVE-2026-89472 is a use-after-free vulnerability in the Linux kernel's power supply charger-manager driver. The root cause is a race condition in the device removal and probe-error paths: charger regulators are freed via regulator_put() before the corresponding power_supply sysfs entries are unre...

CVE-2026-81006 ipmi: Remove all sysfs files on registration failure

In the Linux kernel, the following vulnerability has been resolved: ipmi: Remove all sysfs files on registration failure ipmiaddsmi creates the nrusers and nrmsgs files before trying to create the maintenancemode file. If that last creation fails, the error path removes only nrusers before droppi...

SUSE CVE-2026-80767

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix use-after-free in enablesensor enablesensorstore can call setpowerreportstate, which dereferences sensorinst-powerstate and sensorinst-reportstate. These pointers refer to entries in sensorinst-fields...

AZL-99500 CVE-2026-80767 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix use-after-free in enablesensor enablesensorstore can call setpowerreportstate, which dereferences sensorinst-powerstate and sensorinst-reportstate. These pointers refer to entries in sensorinst-fields...

CVE-2026-80767 HID: sensor: custom: Fix use-after-free in enable_sensor

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix use-after-free in enablesensor enablesensorstore can call setpowerreportstate, which dereferences sensorinst-powerstate and sensorinst-reportstate. These pointers refer to entries in sensorinst-fields...

PT-2026-85608

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the HID sensor custom module. The enable sensor store function can call set power report state, which dereferences sensor inst-power state and sensor...

SUSE CVE-2026-63933

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16260: fix division by zero in writeraw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero to the samplingfrequency sysfs attribute triggers a division by zero...

SUSE CVE-2026-63935

In the Linux kernel, the following vulnerability has been resolved: iio: adc: nxp-sar-adc: fix division by zero in writeraw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero or a negative value to the samplingfrequency sysfs attribute trigge...

CVE-2026-63949

A flaw was found in the Linux kernel's auxdisplay line-display subsystem. A local user can trigger an out-of-bounds read by writing a zero-length message to the message sysfs attribute. This occurs because the linedispdisplay function attempts to read a character from a zero-length buffer, leadin...

CVE-2026-63964

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: reject firmware images without a ':' record header doflash locates the first .cyacd record with p = strnchrfw-data, fw-size, ':'; while p eof s = strnchrp + 1, eof - p - 1, ':'; ... If the firmware image...

CVE-2026-63935

In the Linux kernel, the following vulnerability has been resolved: iio: adc: nxp-sar-adc: fix division by zero in writeraw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero or a negative value to the samplingfrequency sysfs attribute trigge...

CVE-2026-63949 auxdisplay: line-display: fix OOB read on zero-length message_store()

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: line-display: fix OOB read on zero-length messagestore linedispdisplay unconditionally reads msgcount - 1 before checking whether count is zero, so a write of zero bytes to the message sysfs attribute hits msg-1:...

CVE-2026-63935 iio: adc: nxp-sar-adc: fix division by zero in write_raw

In the Linux kernel, the following vulnerability has been resolved: iio: adc: nxp-sar-adc: fix division by zero in writeraw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero or a negative value to the samplingfrequency sysfs attribute trigge...