Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ravb: Fixed the use-after-free issue in ravbtxtimeoutwork. The ravbstop function should call cancelworksync. Otherwise, ravbtxtimeoutwork may use the freed private data after ravbremove is called, as follows: CPU0 CPU1...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: The process of initializing wiphywork before allocating rfkill fails. The issue was reported as a syzbort: an error in cfg80211devfree. When the allocation of rfkill fails, the wiphywork initialization process wil...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: Fixed issues where pending work caused flows to get stuck during cleanup. To clear the flow table when it becomes free, the following sequence typically occurs in order: 1. The gcstep operation is stopped to...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Input: gpio-keys – cancels delayed work only in case of GPIO. The gpiokeys module can accept gpios or interrupts. The module initializes delayed work only in case of gpios and is only used if the debounce timer is not used...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ipv6: mcast: fixed a data race in ipv6mcdown / mldifcwork. idev-mcifccount can be written without proper locking. Originally reported by syzbot 1. This issue was fixed by encapsulating calls to mldifcstopwork and mldgqstopwork...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: netdevsim: Avoid potential loops in nsimdevtrapreportwork. Many syzbot reports include the following trace 1. If nsimdevtrapreportwork cannot acquire the mutex, it should rearm itself at least one jiffie later. 1 Sending NMI...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: rcu-tasks: Fixed a race condition in the schedule function and the flush work operation. When booting secondary CPUs, cpusreadlock/unlock does not keep the online cpumask stable. This temporary change in the online mask result...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: qedi: Fixed a use-after-free bug in qediremove. In qediprobe, we call qediprobe, which initializes &qedi-recoverywork with qedirecoveryhandler and &qedi-boarddisablework with qediboarddisablework. When...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: scsi: Message: mptlan: Fixed a use-after-free bug in mptlanremove, due to a race condition. In mptlanprobe, mptregisterlandevice is called, which initializes the &priv-postbucketstask workqueue. A call to...

Linux Kernel usbnet Driver Race Condition Privilege Escalation Vulnerability

This vulnerability allows physically present attackers to escalate privileges on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the usbnetdeferredkevent work queue. The issue results from the...

SUSE CVE-2026-81004

In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Cancel work cleanly on an error If an error occurs during startup of an IPMI interface, it may have scheduled work to run. The work needs to be canceled before the interface can be freed...

Linux Distros Unpatched Vulnerability : CVE-2026-89464

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - power: supply: twl4030charger: cancel workers via devm bci is devm-allocated. Two workers bci-work and bci-currentworker dereference it. twl4030bciremove disabl...

Linux Distros Unpatched Vulnerability : CVE-2026-89475

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove...

Linux Distros Unpatched Vulnerability : CVE-2026-89738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: at91udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode board.vbuspin && board.vbuspolled, probe arms a self-restarting cycle...

Linux Distros Unpatched Vulnerability : CVE-2026-89585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - auxdisplay: charlcd: cancel backlight work on registration failure With CONFIGCHARLCDBLFLASH, charlcdinit schedules blwork before charlcdregister calls...

Linux Distros Unpatched Vulnerability : CVE-2026-89463

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - power: supply: ucs1002: fix use-after-free on remove ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the...

Linux Distros Unpatched Vulnerability : CVE-2026-89469

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - power: supply: lp8727: fix use-after-free in lp8727releaseirq lp8727isrfunc, the threaded IRQ handler, is the only caller that arms pchg-work via...

Linux Distros Unpatched Vulnerability : CVE-2026-80932

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vsock/virtio: flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. T...

Linux Distros Unpatched Vulnerability : CVE-2026-89548

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SUNRPC: always drain cachecleaner before destroying a cachedetail sunrpcdestroycachedetail only cancels the global cachecleaner delayedwork when cachelist is...

Linux Distros Unpatched Vulnerability : CVE-2026-89739

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition In dwc3gadgetinitendpoint, &dep-nostreamwork is bound with...