AZL-101451 CVE-2026-90031 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: usb-storage: eneub6250: fix race between scan work and probe eneub6250probe calls usbstorprobe2, which starts the usb-storage infrastructure and schedules the delayed scan work. The driver then calls enegetcardtype, which sends a...

CVE-2026-90029

In the Linux kernel, the following vulnerability has been resolved: usb: storage: realtekcr: fix use-after-free on disconnect realtekcrdestructor calls timerdelete before the chip containing the timer is freed. The timer callback may still be running and can rearm itself, resulting in a...

CVE-2026-90031 usb-storage: ene_ub6250: fix race between scan work and probe

In the Linux kernel, the following vulnerability has been resolved: usb-storage: eneub6250: fix race between scan work and probe eneub6250probe calls usbstorprobe2, which starts the usb-storage infrastructure and schedules the delayed scan work. The driver then calls enegetcardtype, which sends a...

EUVD-2026-80637

In the Linux kernel, the following vulnerability has been resolved: usb: storage: realtekcr: fix use-after-free on disconnect realtekcrdestructor calls timerdelete before the chip containing the timer is freed. The timer callback may still be running and can rearm itself, resulting in a...

Linux Distros Unpatched Vulnerability : CVE-2026-90031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb-storage: eneub6250: fix race between scan work and probe eneub6250probe calls usbstorprobe2, which starts the usb-storage infrastructure and schedules the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: USB: Storage: Fix memory leak in USB bulk transport A memory leak in the kernel was identified using the ‘ioctlsg01’ test from the Linux Test Project LTP. The following bytes were observed: 0x53425355. When USB storage devices...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: usb-storage: alauda: Fixed an issue where an uninitialized value was used in alaudacheckmedia. Syzbot reported that KMSAN complained about accessing an uninitialized value within the alauda subdriver of usb-storage. Bug: KMSAN...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: usb-storage: alauda: Check whether the media is initialized. The member “uzonesize” of the struct alaudainfo will remain 0 if alaudainitmedia fails, potentially causing division errors in alaudareaddata and alaudawritelba. - A...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sddr55: Reject out-of-bound newpba This issue was discovered by Atuin – the Automated Vulnerability Discovery Engine. newpba is derived from the status packet returned after each write operation. A malicious device...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: USB: core: Prevent nested device-reset calls Automatic kernel fuzzing revealed a recursive locking violation in usb-storage. ============================================ WARNING: Possible recursive locking detected 5.18.0 3 No...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: USB: usb-storage: A bug that causes a division-by-zero error in the isd200atacommand function has been fixed. The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values in the ATA ID information to calculate the...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-105457)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105457 advisory. In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized The member uzonesize of struct...

EUVD-2025-210676

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to...

CVE-2025-30240

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to...

CVE-2025-30240 Arbitrary File Read via Improper Symlink Handling in USB HTTPS Access Path in multiple TP-Link Aginet Devices

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to...

CVE-2025-30240

CVE-2025-30240 affects TP-Link Aginet devices. The issue arises from improper validation of symbolic links on external USB storage, allowing an attacker to cause the system to resolve a crafted symlink and potentially read sensitive files from the device filesystem. Exploitation details and exact...

CVE-2025-30240

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to...

CVE-2025-30240 Arbitrary File Read via Improper Symlink Handling in USB HTTPS Access Path in multiple TP-Link Aginet Devices

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to...

PT-2026-69994

Name of the Vulnerable Software and Affected Versions TP-Link Aginet affected versions not specified Description TP-Link Aginet devices fail to properly validate symbolic links created on external USB storage devices. A symbolic link is a special type of file that serves as a reference to another...

The vulnerability of the uas_queuecommand_lck() function in the drivers/usb/storage/uas.c module of the Linux operating system’s USB device driver allows a hacker to cause a service failure.

The vulnerability of the uasqueuecommandlck function in the drivers/usb/storage/uas.c module of the Linux device driver framework is related to the pointer that becomes invalid after a certain period of time. Exploiting this vulnerability could allow an attacker to cause a service failure...