CVE-2026-72070 wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()

In the Linux kernel, the following vulnerability has been resolved: wifi: libertastf: fix use-after-free in lbtffreeadapter lbtffreeadapter calls timerdelete&priv-commandtimer, which does not wait for a running commandtimerfn callback. lbtffreeadapter runs on the teardown path right before...

PT-2026-72511

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition occurs between device teardown in inetdev destroy and incoming IGMP query processing in igmp rcv, resulting in a Use-After-Free UAF within the IGMP timer callback. Durin...

CVE-2026-72126: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronizercu in isotprelease isotpnotify unregisters the RCU CAN filters via canrxunregister and clears so-bound without waiting for a grace period. isotprelease uses so-bound to decide whether it...

PT-2026-72315

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ISO-TP implementation of the CAN protocol. The isotp notify function unregisters CAN filters via can rx unregister and clears the so-bound variable without...

SUSE CVE-2026-68090

In the Linux kernel, the following vulnerability has been resolved: debugobjects: Plug race against a concurrent OOM disable syzbot reported a puzzling splat: WARNING: kernel/time/hrtimer.c:443 at stubtimer+0xa/0x20 stubtimer is installed as timer callback function in hrtimerfixupassertinit, whic...

CVE-2026-68198

A flaw was found in the Linux kernel's ath6kl Wi-Fi driver. A use-after-free vulnerability exists within the aggrresetstate function. This occurs because a non-synchronous timer deletion allows a timer callback aggrtimeout to access memory that has already been freed, creating a race condition. A...

CVE-2026-68198 wifi: ath6kl: fix use-after-free in aggr_reset_state()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggrresetstate The aggrresetstate function uses timerdelete non-synchronous for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like...

CVE-2026-53197

A flaw was found in the iptfs module of the Linux kernel. This issue, an ABBA deadlock, occurs when iptfsdestroystate attempts to cancel a timer while holding a spinlock that the timer's callback also tries to acquire. This circular dependency can cause the system to become unresponsive, leading ...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/rxe: Fixed a race condition in QP timer handlers I encountered the following warning: WARNING: drivers/infiniband/sw/rxe/rxetask.c:249 at rxeschedtask+0x1c8/0x238 rdmarxe, CPU0: swapper/0/0 … libsha1 last unloaded:...

CVE-2026-46137

A flaw was found in the Linux kernel, specifically within the Multipath TCP MPTCP implementation. The mptcppmaddtimer helper, which is executed as a timer callback, does not properly hold the socket lock when operating in a softirq context. This oversight can lead to a potential data race, which...

CVE-2026-46137

CVE-2026-46137 affects the Linux kernel MPTCP implementation. The mptcp_pm_add_timer() helper runs as a timer callback in softirq context and can race with socket state unless the socket lock is held with bh_lock_sock(). The mitigation is to hold the lock and retry if the socket is in use, mirror...

CVE-2026-46137 mptcp: pm: ADD_ADDR rtx: fix potential data-race

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADDADDR rtx: fix potential data-race This mptcppmaddtimer helper is executed as a timer callback in softirq context. To avoid any data races, the socket lock needs to be held with bhlocksock. If the socket is in use,...

EUVD-2026-32764

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADDADDR rtx: fix potential data-race This mptcppmaddtimer helper is executed as a timer callback in softirq context. To avoid any data races, the socket lock needs to be held with bhlocksock. If the socket is in use,...

CVE-2026-46137

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADDADDR rtx: fix potential data-race This mptcppmaddtimer helper is executed as a timer callback in softirq context. To avoid any data races, the socket lock needs to be held with bhlocksock. If the socket is in use,...

CVE-2026-43293

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fix kthread worker destruction in polling mode Fix the cleanup order in polling mode irq worklist and WARNON!listempty&worker-delayedworklist. The original code called kthreaddestroyworker before...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000760)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000760 advisory. sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kern...

CVE-2023-52941 can: isotp: split tx timer into transmission and timeout

In the Linux kernel, the following vulnerability has been resolved: can: isotp: split tx timer into transmission and timeout The timer for the transmission of isotp PDUs formerly had two functions: 1. send two consecutive frames with a given time gap 2. monitor the timeouts for flow control frame...

Azure Linux 3.0 Security Update: kernel (CVE-2024-47747)

"The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-47747 advisory. - In the Linux kernel, the following vulnerability has been resolved: net: seeq: Fix use after free...

CVE-2024-41023

In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Fix taskstruct reference leak During the execution of the following stress test with linux-rt: stress-ng --cyclic 30 --timeout 30 --minimize --quiet kmemleak frequently reported a memory leak concerning the...

CVE-2024-41023 sched/deadline: Fix task_struct reference leak

In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Fix taskstruct reference leak During the execution of the following stress test with linux-rt: stress-ng --cyclic 30 --timeout 30 --minimize --quiet kmemleak frequently reported a memory leak concerning the...