CVE-2026-89737 usb: typec: thunderbolt: Disable work before freeing tbt on remove

In the Linux kernel, the following vulnerability has been resolved: usb: typec: thunderbolt: Disable work before freeing tbt on remove tbtaltmoderemove drops the plug and cable references without draining tbt-work. The work function dereferences those references, and can also requeue itself in it...

CVE-2026-89737 usb: typec: thunderbolt: Disable work before freeing tbt on remove

In the Linux kernel, the following vulnerability has been resolved: usb: typec: thunderbolt: Disable work before freeing tbt on remove tbtaltmoderemove drops the plug and cable references without draining tbt-work. The work function dereferences those references, and can also requeue itself in it...

EUVD-2026-76649

In the Linux kernel, the following vulnerability has been resolved: usb: typec: thunderbolt: Disable work before freeing tbt on remove tbtaltmoderemove drops the plug and cable references without draining tbt-work. The work function dereferences those references, and can also requeue itself in it...

CVE-2026-89468

This use-after-free vulnerability affects the lp8788-charger driver in the Linux kernel. During device removal, lp8788_charger_remove() flushed charger_work before unregistering IRQs, allowing an IRQ thread to queue work after the flush completed. That work could then run after devres freed the p...

EUVD-2026-76373

In the Linux kernel, the following vulnerability has been resolved: power: supply: qcombattmgr: fix use-after-free qcombattmgrpdrnotify queues enablework when the PMIC GLINK service comes up, and the worker recovers battmgr through containerof to issue firmware requests. The PMIC GLINK client sta...

CVE-2026-89468 power: supply: lp8788-charger: fix use-after-free on remove

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8788-charger: fix use-after-free on remove lp8788chargerremove flushes chargerwork before unregistering the IRQs. An IRQ thread can queue chargerwork after flushwork has returned. The work can then run after devr...

CVE-2026-89468

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8788-charger: fix use-after-free on remove lp8788chargerremove flushes chargerwork before unregistering the IRQs. An IRQ thread can queue chargerwork after flushwork has returned. The work can then run after devr...

CVE-2026-89467 power: supply: qcom_battmgr: fix use-after-free

In the Linux kernel, the following vulnerability has been resolved: power: supply: qcombattmgr: fix use-after-free qcombattmgrpdrnotify queues enablework when the PMIC GLINK service comes up, and the worker recovers battmgr through containerof to issue firmware requests. The PMIC GLINK client sta...

CVE-2026-89440 mmc: via-sdmmc: stop card-detect handling on probe failure

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: stop card-detect handling on probe failure requestirq registers the SD card-detect interrupt and the probe enables it before mmcaddhost runs. If mmcaddhost fails, the error path only unmaps the registers and...

CVE-2026-81004

CVE-2026-81004 affects the Linux kernel's IPMI message handler (ipmi:msghandler). When an error occurs during the startup of an IPMI interface, scheduled work may not be properly canceled before the interface is freed, which can prevent clean resource release and potentially lead to resource exha...

PT-2026-90453

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the USB Type-C Thunderbolt implementation where the tbt altmode remove function drops plug and cable references without draining tbt-work. Because the work function...

PT-2026-90226

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the RDMA/cxgb4 component. The c4iw remove function can free the ctx-dev object while registration work is still pending or running. This allows the c4iw...

PT-2026-90180

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the twl4030 charger power supply component where the bci structure is allocated via devm. Two workers, bci-work and bci-current worker, dereference this structure. The...

PT-2026-90184

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the lp8788-charger component. The lp8788 charger remove function flushes charger work before unregistering IRQs, which allows an IRQ thread to queue...

PT-2026-90157

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A use-after-free issue exists in the via-sdmmc driver. While disabling device interrupts and freeing the IRQ prevents new card-detect work from being queued, any carddet work already queued ...

CVE-2026-80848 xfrm: espintcp: fix UAF during close

In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: fix UAF during close ZDI reported and analyzed a race condition during close for espintcp sockets: espintcpclose frees emsg-skb via kfreeskb without holding any socket lock. Concurrently, the xfrmtransreinject wor...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-105461)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105461 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: cancel dqisyncwork before freeing oinfo ocfs2globalreadinfo will initialize and schedule...

SUSE CVE-2026-80667

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, MPESW, Fix missing complete on devcom error mlx5mpeswwork returned without calling complete when mlx5laggetdevcomcomp returned NULL. A caller that queued the work and waited on mpesww-comp would block indefinitely...

SUSE CVE-2026-80556

In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: Fix use-after-free in atmciremove due to race condition In atmciprobe, &host-bhwork is bound with atmciworkfunc, and atmciinterrupt, atmcitimeouttimer and atmcidmacomplete can all queue this work on systembhwq. If...

AZL-97700 CVE-2026-80556 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: Fix use-after-free in atmciremove due to race condition In atmciprobe, &host-bhwork is bound with atmciworkfunc, and atmciinterrupt, atmcitimeouttimer and atmcidmacomplete can all queue this work on systembhwq. If...