PT-2026-90100

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the ALSA FCP component where the fcp ioctl init function allocates a response buffer using kmalloc but fails to clear it before copying the entire buffer back to userspace...

PT-2026-90451

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the USB gadget midi2 component. The f midi2 alloc inst function creates default configfs child groups for the default endpoint and default block using configfs ad...

CVE-2026-89733: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvcfunctionbind and uvcfunctionunbind In uvcfunctionbind error path, we use usbepfreerequest which uses uvc-controlreq but does not set it to NULL afterwards. Thus, uvc-controlreq is a...

ROS-20260911-73-0107

The vulnerability of the USB component in Google Chrome and Microsoft Edge browsers is related to the simultaneous execution using a shared resource with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause service interruptions through a specially created HTML...

PT-2026-96510

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: remove default configfs groups on teardown f midi2 alloc inst creates default configfs child groups for the default endpoint and default block using configfs add default group, setting their internal refcount ...

CVE-2026-89738: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode board.vbuspin && board.vbuspolled, probe arms a self-restarting cycle: at91vbustimer schedules vbustimerwork, and at91vbustimerwork calls...

PT-2026-96488

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91 udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode board.vbus pin && board.vbus polled, probe arms a self-restarting cycle: at91 vbus timer schedules vbus timer work, and at91 vbus timer...

PT-2026-90101

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the ALSA bcd2000 driver. The function bcd2000 free usb related resources frees USB Request Blocks URBs but fails to clear the associated pointers. Becaus...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107325)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107325 advisory. In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix race by not overwriting udev-descriptor in hubportinit Syzbot reported an...

PT-2026-90449

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the USB gadget UVC component where the uvc function bind and uvc function unbind functions fail to set pointers to NULL after freeing them. Specifically, in the error...

PT-2026-96361

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f fs: Prevent deadlock during ep0 read loop Currently, ffs ep0 read holds ffs-mutex when it prepares to go to sleep waiting for an event. When no setup events are pending, it calls wait event interruptible exclusive...

CVE-2026-89736: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uaudio: Fix use-after-free on sound card disconnect gaudiocleanup invokes sndcardfreewhenclosed to initiate sound card teardown and immediately frees the underlying struct snduacchip context. However,...

ROS-20260911-73-1107

The vulnerability of the USB component in Google Chrome and Microsoft Edge browsers is related to the simultaneous execution using a shared resource with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause service interruptions through a specially created HTML...

PT-2026-90190

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the bq256xx power supply driver. The USB-PHY notifier queues usb work, which triggers the power supply changed function. Because the reset action was...

PT-2026-90450

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer dereference occurs in the uvcg video init function. When kthread run worker fails, the system attempts to log an error using uvcg err. However, because the video-uvc point...

CVE-2026-89734: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcgvideoinit In uvcgvideoinit, if kthreadrunworker fails, the error logged uses uvcgerr, however, the pointer it uses: video-uvc is not assigned at this point, triggering a null...

PT-2026-96451

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvc function bind and uvc function unbind In uvc function bind error path, we use usb ep free request which uses uvc-control req but does not set it to NULL afterwards. Thus, uvc-control...

PT-2026-90448

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock can occur in the USB gadget functionfs module when a userspace daemon polls ep0 via a read operation while the gadget is asynchronously torn down via configfs. The issue arise...

PT-2026-90452

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free UAF memory corruption exists in the USB gadget u audio component. The g audio cleanup function calls snd card free when closed to start sound card teardown but immediate...

CVE-2026-89732: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent deadlock during ep0 read loop Currently, ffsep0read holds ffs-mutex when it prepares to go to sleep waiting for an event. When no setup events are pending, it calls waiteventinterruptibleexclusivelockedi...