CVE-2026-93162 crypto: qat - cancel work on re-enable SR-IOV timeout

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - cancel work on re-enable SR-IOV timeout The QAT reset worker queues SR-IOV reenable work using a workstruct and completion embedded in an on-stack adfsriovdevdata. If the completion wait times out, the reset worker...

CVE-2026-92486 bpf: Fix CFI mismatch in task work callback

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix CFI mismatch in task work callback BPF subprograms use the bpfcallbackt ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI. Store and invoke the callback as bpfcallbackt...

CVE-2026-92486

CVE-2026-92486 affects the Linux kernel BPF subsystem. The root cause is a kCFI (kernel Control Flow Integrity) mismatch : BPF subprograms use the bpf_callback_t ABI, but the task work mechanism invokes the callback through a three-argument function pointer, causing a CFI violation. The fix store...

EUVD-2026-82107

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix CFI mismatch in task work callback BPF subprograms use the bpfcallbackt ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI. Store and invoke the callback as bpfcallbackt...

CVE-2026-90395 power: supply: isp1704_charger: cancel work on remove

In the Linux kernel, the following vulnerability has been resolved: power: supply: isp1704charger: cancel work on remove The USB notifier and initial VBUS detection can schedule isp-work. The remove path unregisters the notifier and power supply, but does not wait for queued or running work befor...

CVE-2026-90394 power: supply: sc2731_charger: cancel work on remove

In the Linux kernel, the following vulnerability has been resolved: power: supply: sc2731charger: cancel work on remove The USB notifier and initial charger detection can schedule info-work. The remove path unregisters the notifier, but does not cancel queued or running work before the...

EUVD-2026-82055

In the Linux kernel, the following vulnerability has been resolved: power: supply: sc2731charger: cancel work on remove The USB notifier and initial charger detection can schedule info-work. The remove path unregisters the notifier, but does not cancel queued or running work before the...

CVE-2026-90395

CVE-2026-90395 is a race condition in the Linux kernel's isp1704_charger power supply driver. The USB notifier and initial VBUS detection can schedule isp->work, but the remove path unregisters the notifier and power supply without waiting for queued or running work before tearing down the pow...

CVE-2026-90301 ocfs2: o2hb: quiesce negotiate handlers and timeout work

In the Linux kernel, the following vulnerability has been resolved: ocfs2: o2hb: quiesce negotiate handlers and timeout work Heartbeat regions publish struct o2hbregion as the private data for the NEGOTIMEOUT and NEGOAPPROVE o2net handlers as soon as makeitem creates the configfs region. The...

CVE-2026-90168

CVE-2026-90168 affects the ksmbd SMB server component of the Linux kernel . The root cause is a lifetime mismatch: deferred CHANGE_NOTIFY work retains an async message ID after the original request work is released. Because a durable handle can outlive its connection, connection teardown can dest...

CVE-2026-85999 Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selectoriter in src/soupsieve/cssparser.py trims the raw selector with REWSEND, an end-anchored WSC whitespace-and-comment expression used with search, so the regular expression engine retries a greedy...

CVE-2026-90021

A flaw was found in the Linux kernel's USB MIDI gadget driver fmidi. When a sound card is not registered, a work queue item may not be properly initialized. This can lead to a warning and a potential system crash, resulting in a Denial of Service DoS for a local attacker...

CVE-2026-92486: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix CFI mismatch in task work callback BPF subprograms use the bpfcallbackt ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI. Store and invoke the callback as bpfcallbackt...

CVE-2026-90395: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: power: supply: isp1704charger: cancel work on remove The USB notifier and initial VBUS detection can schedule isp-work. The remove path unregisters the notifier and power supply, but does not wait for queued or running work befor...

CVE-2026-85999: Uncontrolled Resource Consumption

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selectoriter in src/soupsieve/cssparser.py trims the raw selector with REWSEND, an end-anchored WSC whitespace-and-comment expression used with search, so the regular expression engine retries a greedy...

PT-2026-94386

Name of the Vulnerable Software and Affected Versions Soup Sieve versions prior to 2.9 Description An issue exists in the selector iter function within src/soupsieve/css parser.py where the raw selector is trimmed using RE WS END. Because this regular expression is anchored only at the end and us...

CVE-2026-81176

A flaw was found in the Svelte devalue library. An attacker can provide a specially crafted, untrusted payload to the devalue.parse function. This malformed input, specifically out-of-bounds indices, can cause the parser to perform quadratic work, leading to a denial of service DoS in application...

CVE-2026-81176

Svelte devalue is a JavaScript library used for serializing values beyond what JSON.stringify supports. Prior to 5.9.2 , the devalue.parse function in src/parse.js failed to reject out-of-bounds indices greater than or equal to values.length. A specially crafted untrusted payload can cause the pa...

CVE-2026-81176 Svelte devalue: DoS via malformed input

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload c...

CVE-2026-81176 Svelte devalue: DoS via malformed input

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload c...