CVE-2026-81004 ipmi:msghandler: Cancel work cleanly on an error

In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Cancel work cleanly on an error If an error occurs during startup of an IPMI interface, it may have scheduled work to run. The work needs to be canceled before the interface can be freed...

EUVD-2026-76327

In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Cancel work cleanly on an error If an error occurs during startup of an IPMI interface, it may have scheduled work to run. The work needs to be canceled before the interface can be freed...

CVE-2026-81004

In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Cancel work cleanly on an error If an error occurs during startup of an IPMI interface, it may have scheduled work to run. The work needs to be canceled before the interface can be freed...

CVE-2026-80936 wifi: mt76: mt7925: cancel mlo_pm_work on stop

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel mlopmwork on stop mt7925 queues mlopmwork with a 5 second delay during multi-link power-save setup and never cancels it on the stop path. If the device is torn down inside that window, the work outlives...

CVE-2026-80932

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

EUVD-2026-76255

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

CVE-2026-80932

A use-after-free vulnerability in the Linux kernel's vsock/virtio component is triggered during virtio_vsock_remove(). The function flushes work items before freeing the virtio_vsock object, but the flush order ignores dependencies: send_pkt_work can queue rx_work after the remove path has alread...

CVE-2026-80932 vsock/virtio: flush works in dependency order

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

PT-2026-90181

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the rt9455 power supply driver during the teardown process. The rt9455 remove function cancels max charging time work before batt presence work, allowing the...

PT-2026-90455

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the usb dwc3 gadget component due to a race condition. In dwc3 gadget init endpoint, the &dep-nostream work is bound with dwc3 nostream work. When a DEPE...

CVE-2026-89441: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddetwork already queued by the handler can still run after viasdremove...

PT-2026-90454

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the at91 udc USB gadget driver when operating in polled-VBUS mode. In this mode, a self-restarting cycle is established where at91 vbus timer schedules vbus timer work...

PT-2026-96387

In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat ceph trim dentries if no progress possible ceph cap reclaim work re-queues itself for as long as ceph trim dentries returns -EAGAIN, which happens whenever a lease walk exhausts its nr to scan budget. This...

PT-2026-90066

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the mt7925 driver where mlo pm work is queued with a 5-second delay during multi-link power-save setup but is not cancelled during the stop path. If the device is torn dow...

PT-2026-90140

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the io uring/waitid component where the io waitid cb function fails to honor task work cancellation. When task work add cannot queue work to the originating task, the...

PT-2026-90177

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists during system suspend in the fuel gauge driver. The function max17040 work requeues itself after every poll, but the use of cancel delayed work only cancels pendi...

PT-2026-90185

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the lp8727 release irq function. The threaded IRQ handler lp8727 isr func arms pchg-work using schedule delayed work. Because lp8727 release irq cancels...

PT-2026-90453

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the USB Type-C Thunderbolt implementation where the tbt altmode remove function drops plug and cable references without draining tbt-work. Because the work function...

PT-2026-90179

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the ucs1002 power supply driver. The alert IRQ handler queues health poll delayed work, which can reschedule itself during bad-health conditions. Because...

PT-2026-90190

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the bq256xx power supply driver. The USB-PHY notifier queues usb work, which triggers the power supply changed function. Because the reset action was...