CVE-2026-89737 usb: typec: thunderbolt: Disable work before freeing tbt on remove

In the Linux kernel, the following vulnerability has been resolved: usb: typec: thunderbolt: Disable work before freeing tbt on remove tbtaltmoderemove drops the plug and cable references without draining tbt-work. The work function dereferences those references, and can also requeue itself in it...

CVE-2026-89738 usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode board.vbuspin && board.vbuspolled, probe arms a self-restarting cycle: at91vbustimer schedules vbustimerwork, and at91vbustimerwork calls...

CVE-2026-89681 nfsd: fix layout fence worker double-reference race

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix layout fence worker double-reference race The workqueue core clears WORKSTRUCTPENDING before the callback is invoked, so delayedworkpending in lmbreakertimedout can return false while the fence worker is already running...

CVE-2026-89647

CVE-2026-89647 affects the Linux kernel's Ceph file system . The function ceph_cap_reclaim_work() enters a busy loop by re-queuing itself whenever ceph_trim_dentries() returns -EAGAIN, which occurs when a lease walk exhausts its scan budget with no cap pressure and all leases still valid. The dir...

CVE-2026-89603

This CVE ID is rejected/not used as explicitly stated in the Initial Description, and therefore does not represent an active vulnerability entry.

CVE-2026-89603

Removed by vendor...

CVE-2026-89585 auxdisplay: charlcd: cancel backlight work on registration failure

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIGCHARLCDBLFLASH, charlcdinit schedules blwork before charlcdregister calls miscregister. If registration fails, the caller frees the charlcd object whil...

CVE-2026-89585 auxdisplay: charlcd: cancel backlight work on registration failure

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIGCHARLCDBLFLASH, charlcdinit schedules blwork before charlcdregister calls miscregister. If registration fails, the caller frees the charlcd object whil...

CVE-2026-89585

A use-after-free vulnerability in the Linux kernel's auxdisplay: charlcd driver occurs when charlcd_init() schedules a delayed backlight work item (bl_work) before charlcd_register() completes. If registration fails, the charlcd object is freed while the delayed work still holds its address. A lo...

CVE-2026-89585

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIGCHARLCDBLFLASH, charlcdinit schedules blwork before charlcdregister calls miscregister. If registration fails, the caller frees the charlcd object whil...

EUVD-2026-76497

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIGCHARLCDBLFLASH, charlcdinit schedules blwork before charlcdregister calls miscregister. If registration fails, the caller frees the charlcd object whil...

EUVD-2026-76459

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cachecleaner before destroying a cachedetail sunrpcdestroycachedetail only cancels the global cachecleaner delayedwork when cachelist is empty. During per-netns teardown cachelist is never empty because...

CVE-2026-89548 SUNRPC: always drain cache_cleaner before destroying a cache_detail

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cachecleaner before destroying a cachedetail sunrpcdestroycachedetail only cancels the global cachecleaner delayedwork when cachelist is empty. During per-netns teardown cachelist is never empty because...

CVE-2026-89523 wifi: mt76: mt7925: cancel pending mlo_pm_work

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlopmwork If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the...

CVE-2026-89523 wifi: mt76: mt7925: cancel pending mlo_pm_work

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlopmwork If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the...

CVE-2026-89523

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlopmwork If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the...

EUVD-2026-76429

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlopmwork If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the...

CVE-2026-89523

This vulnerability affects the MediaTek mt7925 Wi-Fi driver in the Linux kernel (part of the mt76 subsystem). A pending delayed work item (mlo_pm_work) may continue executing after the device is reset, suspended, or unregistered, leading to a use-after-free on vif/bss data or MCU commands sent to...

CVE-2026-89475 power: supply: bq24257: fix use-after-free on remove

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove returns. remove cancels bq-iilimitsetupwork while the threaded handler c...

CVE-2026-89475

A use-after-free vulnerability in the Linux kernel's bq24257 power supply driver is triggered during device removal. The STAT-pin interrupt is devm-managed and stays armed until devm cleanup runs after remove() returns. While remove() cancels the iilimit_setup_work, the threaded interrupt handler...