CVE-2026-99050 gpio: mpsse: fix race when arming the IRQ poll worker

In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpiompsseirqenable arms the poll worker before publishing it: schedulework runs before the worker is added to priv-workers. If gpiompssedisconnect walks the list in that windo...

EUVD-2026-108845

In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpiompsseirqenable arms the poll worker before publishing it: schedulework runs before the worker is added to priv-workers. If gpiompssedisconnect walks the list in that windo...

CVE-2026-99050

The Linux kernel contains a race condition in the gpio: mpsse component. Specifically, gpio_mpsse_irq_enable() arms the poll worker before it is published, creating a window where gpio_mpsse_disconnect() might miss the worker. This results in a use-after-free vulnerability because the USB core fr...

CVE-2026-99050 gpio: mpsse: fix race when arming the IRQ poll worker

In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpiompsseirqenable arms the poll worker before publishing it: schedulework runs before the worker is added to priv-workers. If gpiompssedisconnect walks the list in that windo...

EUVD-2026-108839

In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup icedeallocdynamicport uses dynport-vsi-idx to erase the dynamic port from pf-dynports. However, it frees the VSI before reading the index for the erase, resulting in a use-after-fre...

CVE-2026-99044 ice: fix use-after-free in dynamic port cleanup

In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup icedeallocdynamicport uses dynport-vsi-idx to erase the dynamic port from pf-dynports. However, it frees the VSI before reading the index for the erase, resulting in a use-after-fre...

CVE-2026-99044 ice: fix use-after-free in dynamic port cleanup

In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup icedeallocdynamicport uses dynport-vsi-idx to erase the dynamic port from pf-dynports. However, it frees the VSI before reading the index for the erase, resulting in a use-after-fre...

CVE-2026-99044

A use-after-free vulnerability exists in the Linux kernel 's ice driver during dynamic port cleanup. Specifically, the ice_dealloc_dynamic_port() function attempts to access dyn_port->vsi->idx to erase a dynamic port from pf->dyn_ports, but it incorrectly frees the VSI before reading the...

CVE-2026-99044

In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup icedeallocdynamicport uses dynport-vsi-idx to erase the dynamic port from pf-dynports. However, it frees the VSI before reading the index for the erase, resulting in a use-after-fre...

CVE-2026-99043 ice: fix metadata_dst refcount handling on representor teardown

In the Linux kernel, the following vulnerability has been resolved: ice: fix metadatadst refcount handling on representor teardown iceeswitchreleaserepr uses metadatadstfree to release the representor's metadatadst. metadatadstfree directly frees the underlying memory without checking the dstentr...

CVE-2026-99043 ice: fix metadata_dst refcount handling on representor teardown

In the Linux kernel, the following vulnerability has been resolved: ice: fix metadatadst refcount handling on representor teardown iceeswitchreleaserepr uses metadatadstfree to release the representor's metadatadst. metadatadstfree directly frees the underlying memory without checking the dstentr...

CVE-2026-99043

The Linux kernel contains a vulnerability in the ice driver where ice_eswitch_release_repr() incorrectly uses metadata_dst_free() to release the representor's metadata_dst. This function frees memory directly without checking the dst_entry refcount. Consequently, if a representor is torn down whi...

EUVD-2026-108838

In the Linux kernel, the following vulnerability has been resolved: ice: fix metadatadst refcount handling on representor teardown iceeswitchreleaserepr uses metadatadstfree to release the representor's metadatadst. metadatadstfree directly frees the underlying memory without checking the dstentr...

CVE-2026-99039 memstick: core: wait for request completion before freeing card

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstickalloccard and memsticksetrwaddr, waitforcompletiontimeout is used to wait for device identification and address configuration requests to complete. The...

CVE-2026-99039

A slab-use-after-free vulnerability exists in the Linux kernel memstick subsystem within the memstick_alloc_card() and memstick_set_rw_addr() functions. The issue arises because the subsystem uses wait_for_completion_timeout() without a cancellation callback for in-flight requests. If the timeout...

CVE-2026-99039 memstick: core: wait for request completion before freeing card

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstickalloccard and memsticksetrwaddr, waitforcompletiontimeout is used to wait for device identification and address configuration requests to complete. The...

EUVD-2026-108834

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstickalloccard and memsticksetrwaddr, waitforcompletiontimeout is used to wait for device identification and address configuration requests to complete. The...

CVE-2026-99035 mmc: mtk-sd: Cancel request timeout work on remove

In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues reqtimeout while a request is active. msdcrequestdone uses canceldelayedwork, which does not wait for a timeout callback that has already started. The timeout...

CVE-2026-99035 mmc: mtk-sd: Cancel request timeout work on remove

In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues reqtimeout while a request is active. msdcrequestdone uses canceldelayedwork, which does not wait for a timeout callback that has already started. The timeout...

CVE-2026-99035

The Linux kernel contains a vulnerability in the mmc: mtk-sd driver where a use-after-free access occurs during the unbind process. The root cause is that msdc_drv_remove() can return and free the managed mmc_host before a req_timeout callback finishes executing. The callback incorrectly continue...