PT-2026-90454

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the at91 udc USB gadget driver when operating in polled-VBUS mode. In this mode, a self-restarting cycle is established where at91 vbus timer schedules vbus timer work...

PT-2026-90171

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the PCI plda driver during the teardown of event IRQs. The function plda pcie irq domain deinit removes the pcie-event domain using irq domain remove, bu...

PT-2026-90339

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the HID mcp2221 driver. The problem occurs because incoming HID reports can race with hardware teardown during device removal or probe failure. This is...

CVE-2026-80984: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: do not dereference an unset send buffer on the SMC-D teardown path smcclosestreamwait calls smctxpreparedsends from inside its skwaitevent condition, and skwaitevent evaluates that condition once with the socket lock...

PT-2026-96376

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovs mutex. The CT limit pointer was neither removed from readers nor protected by a...

PT-2026-96404

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smc switch conns smc switch conns takes a reference on the SMC socket before dropping lgr-conns lock, so the connection stays alive while the CDC slot is fetched: sock hold&smc-sk; read unlock...

CVE-2026-89488: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovsmutex. The CT limit pointer was neither removed from readers nor protected by a gra...

CVE-2026-89548: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cachecleaner before destroying a cachedetail sunrpcdestroycachedetail only cancels the global cachecleaner delayedwork when cachelist is empty. During per-netns teardown cachelist is never empty because...

PT-2026-90424

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the nfsd component during session teardown. After a DESTROY SESSION operation, the teardown path may free a session while the rpciod still holds an...

PT-2026-90204

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the openvswitch component of the Linux kernel. The problem occurs because packet processing utilizes the Connection Tracking CT limit state under...

PT-2026-90264

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the SUNRPC component. The function sunrpc destroy cache detail only cancels the global cache cleaner delayed work when the cache list is empty. During...

PT-2026-90451

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the USB gadget midi2 component. The f midi2 alloc inst function creates default configfs child groups for the default endpoint and default block using configfs ad...

PT-2026-90398

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the nfsd component. The function nfsd file dispose list delayed defers fput to nfsd service threads using a per-net freeme queue stored in a separately...

PT-2026-90351

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd module where the ksmbd reopen durable fd function incorrectly rebinds all detached oplocks on an inode to a reconnecting session instead of only the oplock...

CVE-2026-89715: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfsuuidaddfile failure When nfsuuidaddfile races with nfsuuidput tearing down uuid-net, it returns -ENXIO without publishing nfl-nfsuuid via rcuassignpointer. nfsopenlocalfh then enters its error bran...

PT-2026-90431

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak occurs in the NFS localio component when the nfs uuid add file function races with nfs uuid put during the teardown of uuid-net. In this scenario, the system returns...

PT-2026-90391

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the nfsd component during async copy cancel and shutdown operations. A race condition occurs between a teardown caller such as OFFLOAD CANCEL, nfsd4...

PT-2026-90119

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the thunderbolt network component where failure paths in the tbnet connected work function do not clear the login sent variable. This causes the connection to appear...

PT-2026-90479

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the trusted key subsystem where the trusted tpm exit function releases the TPM chip reference and frees the digest array before unregistering the trusted key type. Thi...

CVE-2026-88270 GV-LPC2011/LPC2211 - SSVR Guest Firmware-Mode Pre-Validation Service Teardown Denial of Service

GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated...