DEBIAN-CVE-2026-89739

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition In dwc3gadgetinitendpoint, &dep-nostreamwork is bound with dwc3nostreamwork, and dwc3gadgetendpointstreamevent can queue this delayed work on...

AZL-100542 CVE-2026-89738 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode board.vbuspin && board.vbuspolled, probe arms a self-restarting cycle: at91vbustimer schedules vbustimerwork, and at91vbustimerwork calls...

DEBIAN-CVE-2026-89737

In the Linux kernel, the following vulnerability has been resolved: usb: typec: thunderbolt: Disable work before freeing tbt on remove tbtaltmoderemove drops the plug and cable references without draining tbt-work. The work function dereferences those references, and can also requeue itself in it...

CVE-2026-89737

In the Linux kernel, the following vulnerability has been resolved: usb: typec: thunderbolt: Disable work before freeing tbt on remove tbtaltmoderemove drops the plug and cable references without draining tbt-work. The work function dereferences those references, and can also requeue itself in it...

CVE-2026-89739

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition In dwc3gadgetinitendpoint, &dep-nostreamwork is bound with dwc3nostreamwork, and dwc3gadgetendpointstreamevent can queue this delayed work on...

UBUNTU-CVE-2026-89739

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition In dwc3gadgetinitendpoint, &dep-nostreamwork is bound with dwc3nostreamwork, and dwc3gadgetendpointstreamevent can queue this delayed work on...

CVE-2026-89739

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition In dwc3gadgetinitendpoint, &dep-nostreamwork is bound with dwc3nostreamwork, and dwc3gadgetendpointstreamevent can queue this delayed work on...

UBUNTU-CVE-2026-89737

In the Linux kernel, the following vulnerability has been resolved: usb: typec: thunderbolt: Disable work before freeing tbt on remove tbtaltmoderemove drops the plug and cable references without draining tbt-work. The work function dereferences those references, and can also requeue itself in it...

CVE-2026-89737

In the Linux kernel, the following vulnerability has been resolved: usb: typec: thunderbolt: Disable work before freeing tbt on remove tbtaltmoderemove drops the plug and cable references without draining tbt-work. The work function dereferences those references, and can also requeue itself in it...

AZL-100451 CVE-2026-89585 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIGCHARLCDBLFLASH, charlcdinit schedules blwork before charlcdregister calls miscregister. If registration fails, the caller frees the charlcd object whil...

DEBIAN-CVE-2026-89585

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIGCHARLCDBLFLASH, charlcdinit schedules blwork before charlcdregister calls miscregister. If registration fails, the caller frees the charlcd object whil...

CVE-2026-89585

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIGCHARLCDBLFLASH, charlcdinit schedules blwork before charlcdregister calls miscregister. If registration fails, the caller frees the charlcd object whil...

AZL-100743 CVE-2026-89548 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cachecleaner before destroying a cachedetail sunrpcdestroycachedetail only cancels the global cachecleaner delayedwork when cachelist is empty. During per-netns teardown cachelist is never empty because...

DEBIAN-CVE-2026-89523

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlopmwork If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the...

CVE-2026-89523

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlopmwork If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the...

DEBIAN-CVE-2026-89510

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel regwork before freeing device on remove c4iwuldstatechange queues regwork to register the RDMA device. c4iwremove can free ctx-dev while this work is pending or running, leaving c4iwregisterdevice accessing the...

AZL-100115 CVE-2026-89510 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel regwork before freeing device on remove c4iwuldstatechange queues regwork to register the RDMA device. c4iwremove can free ctx-dev while this work is pending or running, leaving c4iwregisterdevice accessing the...

DEBIAN-CVE-2026-89469

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727releaseirq lp8727isrfunc, the threaded IRQ handler, is the only caller that arms pchg-work via scheduledelayedwork. lp8727releaseirq currently cancels the work before freeing the...

AZL-100229 CVE-2026-89469 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727releaseirq lp8727isrfunc, the threaded IRQ handler, is the only caller that arms pchg-work via scheduledelayedwork. lp8727releaseirq currently cancels the work before freeing the...

AZL-100208 CVE-2026-89475 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove returns. remove cancels bq-iilimitsetupwork while the threaded handler c...