PT-2026-90264

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the SUNRPC component. The function sunrpc destroy cache detail only cancels the global cache cleaner delayed work when the cache list is empty. During...

PT-2026-90454

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the at91 udc USB gadget driver when operating in polled-VBUS mode. In this mode, a self-restarting cycle is established where at91 vbus timer schedules vbus timer work...

CVE-2026-89739: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition In dwc3gadgetinitendpoint, &dep-nostreamwork is bound with dwc3nostreamwork, and dwc3gadgetendpointstreamevent can queue this delayed work on...

PT-2026-96387

In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat ceph trim dentries if no progress possible ceph cap reclaim work re-queues itself for as long as ceph trim dentries returns -EAGAIN, which happens whenever a lease walk exhausts its nr to scan budget. This...

PT-2026-90140

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the io uring/waitid component where the io waitid cb function fails to honor task work cancellation. When task work add cannot queue work to the originating task, the...

PT-2026-90157

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A use-after-free issue exists in the via-sdmmc driver. While disabling device interrupts and freeing the IRQ prevents new card-detect work from being queued, any carddet work already queued ...

CVE-2026-89441: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddetwork already queued by the handler can still run after viasdremove...

PT-2026-96508

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex mt7615 suspend acquired the mt76 mutex and then called cancel delayed work sync on mac work. mt7615 mac work acquires the same mutex via mt7615 mutex acquire at...

PT-2026-96528

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Release the Rx HopID that was handed out on mismatch tb xdomain alloc in hopid passes the wanted HopID to ida alloc range as the lower bound, so a taken id is not an error there: the allocator returns the next...

PT-2026-90134

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ipmi:msghandler where scheduled work may not be properly canceled if an error occurs during the startup of an IPMI interface. This prevents the interface from bein...

PT-2026-90177

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists during system suspend in the fuel gauge driver. The function max17040 work requeues itself after every poll, but the use of cancel delayed work only cancels pendi...

PT-2026-90180

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the twl4030 charger power supply component where the bci structure is allocated via devm. Two workers, bci-work and bci-current worker, dereference this structure. The...

PT-2026-90185

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the lp8727 release irq function. The threaded IRQ handler lp8727 isr func arms pchg-work using schedule delayed work. Because lp8727 release irq cancels...

CVE-2026-89465: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can queue pwrrdywork, maxchargingtimework and battpresencework. pwrrdywork and battpresencework can also queue maxchargingtimework, while...

PT-2026-90062

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the Linux kernel within the virtio vsock implementation. The virtio vsock remove function stops virtqueues and flushes work items before freeing the...

PT-2026-96435

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtio vsock remove stops the virtqueues and then flushes each work item before freeing the enclosing virtio vsock. The current order does not account for dependencies between those...

PT-2026-90239

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the mt76 driver for mt7925 wifi devices, pending mlo pm work may execute after a device is reset, suspended, or unregistered. This can lead to the system accessing freed vif/bss data ...

PT-2026-90190

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the bq256xx power supply driver. The USB-PHY notifier queues usb work, which triggers the power supply changed function. Because the reset action was...

CVE-2026-81004: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Cancel work cleanly on an error If an error occurs during startup of an IPMI interface, it may have scheduled work to run. The work needs to be canceled before the interface can be freed...

PT-2026-90191

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the bq24257 power supply driver. The STAT-pin interrupt is managed by devm, meaning it remains active until the devm cleanup process occurs after the...