CVE-2026-89662

A flaw was found in the Linux kernel's Network File System Daemon NFSD. During client teardown, a race condition can occur where a lock owner is freed while still being referenced, leading to a use-after-free vulnerability. This can result in a NULL dereference, potentially causing a system crash...

CVE-2026-80984

A flaw was found in the net/smc component of the Linux kernel. When a link group terminates while a socket is waiting in smcclosestreamwait, a NULL pointer dereference can occur during the SMC-D teardown path. This can lead to a system crash, resulting in a Denial of Service DoS...

CVE-2026-89735

A flaw was found in the Linux kernel's USB gadget MIDI2 driver. The driver fails to properly remove default configuration file system configfs groups during teardown, leading to a resource leak. A local attacker could exploit this vulnerability to cause memory exhaustion, potentially resulting in...

CVE-2026-89455

A flaw was found in the Linux kernel's PCI PLDA driver. During the teardown of Interrupt Request IRQ domains, the system can attempt to access memory that has already been freed. This 'use-after-free' vulnerability occurs because the domain's internal data is released before all associated IRQs a...

CVE-2026-89763

A flaw was found in the Linux kernel's Trusted Platform Module TPM trusted keys subsystem. An incorrect teardown ordering during the exit process of trusted TPM keys can lead to a race condition. This allows a local attacker to potentially dereference a freed memory region, resulting in a...

CVE-2026-89682

A flaw was found in the Linux kernel's NFS daemon nfsd component. The nfsdfiledisposelistdelayed function, responsible for deferring file disposal, uses a separately allocated structure for its freeme queue. During network namespace teardown, this structure can be prematurely freed. This allows...

CVE-2026-89763

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trustedtpmexit drops the TPM chip reference and frees the digest array before unregistering the trusted key type. keytypelookup holds keytypessem for reading until the key operation...

CVE-2026-89732

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent deadlock during ep0 read loop Currently, ffsep0read holds ffs-mutex when it prepares to go to sleep waiting for an event. When no setup events are pending, it calls waiteventinterruptibleexclusivelockedi...

CVE-2026-89715

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfsuuidaddfile failure When nfsuuidaddfile races with nfsuuidput tearing down uuid-net, it returns -ENXIO without publishing nfl-nfsuuid via rcuassignpointer. nfsopenlocalfh then enters its error bran...

CVE-2026-89708

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...

CVE-2026-89675

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller OFFLOADCANCEL, nfsd4shutdowncopy, nfsd4cancelcopybysb raced the copy kthread: - findasynccopy bumped...

CVE-2026-89658

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup nfs40cleanadminrevoked takes a stateid reference under clp-cllock, drops nn-clientlock, and calls nfsd4droprevokedstid, which dereferences the stateid's...

CVE-2026-89660

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4client; a stateid reference does not pin it. The client survives only because destroyclient drains its stateids befo...

CVE-2026-89662

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown destroyclient releases a client's open owners, but a lock owner whose only reference is a blocked lock nbl stays on clownerstrhashtbl. clienthasstate does not count a...

CVE-2026-89569

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

CVE-2026-89548

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cachecleaner before destroying a cachedetail sunrpcdestroycachedetail only cancels the global cachecleaner delayedwork when cachelist is empty. During per-netns teardown cachelist is never empty because...

CVE-2026-89523

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlopmwork If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the...

CVE-2026-89488

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovsmutex. The CT limit pointer was neither removed from readers nor protected by a gra...

CVE-2026-80995

In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctproutelookup mctproutelookup uses rt-dev without holding a reference on it. mctproutelookupsingle returns the route under RCU only, so the route's device can be torn down...

CVE-2026-80989

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Mark the connection down when bringing it up fails Every failure path in tbnetconnectedwork undoes its own work and returns without clearing loginsent, so the connection still looks established. The next...