CVE-2026-68396 scsi: core: wake eh reliably when using scsi_schedule_eh

In the Linux kernel, the following vulnerability has been resolved: scsi: core: wake eh reliably when using scsischeduleeh Drivers which use the scsischeduleeh function to run the error handler currently risk the error handler thread never waking once all commands are timed out or inactive. There...

EUVD-2026-55582

In the Linux kernel, the following vulnerability has been resolved: scsi: core: wake eh reliably when using scsischeduleeh Drivers which use the scsischeduleeh function to run the error handler currently risk the error handler thread never waking once all commands are timed out or inactive. There...

CVE-2026-68334 rxrpc: fix io_thread race in rxrpc_wake_up_io_thread()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix iothread race in rxrpcwakeupiothread rxrpcwakeupiothread checks local-iothread before waking it, but then reloads the pointer for wakeupprocess. local-iothread is cleared with WRITEONCE when the I/O thread exits, so th...

EUVD-2026-55435

In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix iothread race in rxrpcwakeupiothread rxrpcwakeupiothread checks local-iothread before waking it, but then reloads the pointer for wakeupprocess. local-iothread is cleared with WRITEONCE when the I/O thread exits, so th...

CVE-2026-68334

CVE-2026-68334 concerns the Linux kernel rxrpc subsystem. The issue arises in rxrpc_wake_up_io_thread(), which checks local->io_thread before waking it but then reloads the pointer for wake_up_process(), allowing a race because local->io_thread can be cleared by WRITE_ONCE() when the I/O th...

usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown

...

CVE-2026-64583

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: bdc: free IRQ and drain funcwakenotify before teardown The Broadcom BDC UDC driver registers its IRQ handler with devmrequestirq in bdcudcinit, so the IRQ is released by devm only after bdcremove returns. devm...

CVE-2026-25288

Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size...

CVE-2026-25288 Buffer Over-read in WLAN Firmware

Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size...

CVE-2026-25288 Buffer Over-read in WLAN Firmware

Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size...

CVE-2026-25288

CVE-2026-25288 refers to a transient denial-of-service in WLAN firmware when handling a short target wake time channel usage response frame built with insufficient packet size. Documented in multiple sources (CVE, NVD, CVE list, EUVD), this appears to affect WLAN firmware as reported, with root c...

EUVD-2026-52736

Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size...

CVE-2026-25288

Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size...

CVE-2026-25288: Buffer Over-read

Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size...

CVE-2026-64470

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on marvell probe failure Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe failures to avoid use-after-free in the completion callback. This issue...

CVE-2026-64281

In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svcrdmasqwait on scsqticketwait or scsendwait can hang indefinitely in TASKUNINTERRUPTIBLE state across transport teardown, pinning svcxprt references and...

UBUNTU-CVE-2026-64281

In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svcrdmasqwait on scsqticketwait or scsendwait can hang indefinitely in TASKUNINTERRUPTIBLE state across transport teardown, pinning svcxprt references and...

CVE-2026-64514

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: gate mustwait writability check on ptepresent userfaultfdmustwait and userfaultfdhugemustwait read the PTE without taking the page table lock and then apply ptewrite / hugeptewrite to it. Those accessors decode bits...

CVE-2026-64281

CVE-2026-64281 affects the Linux kernel svcrdma transport (svc_rdma) where threads parked in svc_rdma_sq_wait() could hang indefinitely during transport teardown due to missing wakeups on close. The fixed flow adds svc_rdma_xprt_deferred_close(), which calls svc_xprt_deferred_close() and then wak...

CVE-2026-64281 svcrdma: wake sq waiters when the transport closes

In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svcrdmasqwait on scsqticketwait or scsendwait can hang indefinitely in TASKUNINTERRUPTIBLE state across transport teardown, pinning svcxprt references and...