CVE-2026-64358 media: mtk-jpeg: cancel workqueue on release for supported platforms only

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent fix the mtkjpegrelease function cancels any pending or running work present in the driver workqueue using cancelworksync function. Currently...

CVE-2026-64262 fuse-uring: end fuse_req on io-uring cancel task work

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fusereq on io-uring cancel task work When iouring delivers task work with tw.cancel set PFEXITING, PFKTHREAD fallback, or percpurefisdying on the ring context, fuseuringsendintask takes the cancel branch, assigns...

CVE-2026-64261 fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuseuringasyncstopqueues fuseuringasyncstopqueues might run when the last reference on ring-queuerefs was already dropped. In order to avoid an early destruction a reference on struct fuseconn ...

CVE-2026-64261 fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuseuringasyncstopqueues fuseuringasyncstopqueues might run when the last reference on ring-queuerefs was already dropped. In order to avoid an early destruction a reference on struct fuseconn ...

SUSE CVE-2026-64214

In the Linux kernel, the following vulnerability has been resolved: powerpc/time: Remove redundant preemptdisable|enable calls from archirqworkraise A kernel panic is observed when handling machine check exceptions from real mode. BUG: Unable to handle kernel data access on read at...

SUSE CVE-2026-64218

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix reportwork leak on backbonegw purge batadvblapurgebackbonegw removes stale backbone gateway entries, but fails to properly handle their associated reportwork: - If reportwork is running, the purge must wait f...

SUSE CVE-2026-64248

In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stopthiscpu smpsendstop parks all secondary CPUs in stopthiscpu. The function marks the CPU offline for the scheduler via setcpuonlinefalse but never informs RCU, so RCU keeps expecting a...

SUSE CVE-2026-64250

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Report dying CPU to RCU in stopthiscpu This is a port of MIPS commit 9f3f3bdc6d9dac1 "MIPS: smp: report dying CPU to RCU in stopthiscpu". smpsendstop parks all secondary CPUs in stopthiscpu. And the function marks the...

PT-2026-64579

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the mtk-jpeg driver, the mtk jpeg release function unconditionally calls the cancel work sync function to cancel pending or running work in the driver workqueue. However, only...

PT-2026-64702

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA hda/cs35l41 component where cs35l41 hda creates ALSA controls with private data pointing to the cs35l41 hda object. The firmware load control can queue fw loa...

PT-2026-64712

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the ALSA usx2y driver for us144mkii devices. The tascam disconnect function cancels capture work and midi in work before calling usb kill anchored...

PT-2026-64482

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the fuse-uring component. The function fuse uring async stop queues may execute after the final reference on the ring-queue refs variable has been droppe...

PT-2026-64631

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter flowtable where IPIP tunnel hardware offload is not supported because no driver currently supports this scenario. The system previously enqueued offload...

PT-2026-64617

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the ksmbd component during the cancellation of deferred locks in the SMB2 LOCK path. When a blocking byte-range lock request is deferred, the system...

PT-2026-64645

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free error exists in the netpoll component during the shutdown path. The issue occurs when a pending TX worker runs in parallel with the cleanup process. Specifically, the...

PT-2026-64550

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the USB Type-C UCSI CCG driver. The threaded IRQ handler ccg irq handler invokes ucsi notify common, which may trigger ucsi connector change and schedule...

PT-2026-64646

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the io uring/io-wq component where the io worker handle work function fails to properly re-check the IO WQ BIT EXIT bit for each item in a dependent linked-work chain...

PT-2026-64659

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the crypto: qat component due to a race condition during VF2PF work teardown. The adf disable sriov function destroys per-VF mutexes and frees the vf inf...

PT-2026-64583

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the HID lg-g15 driver. The lg g15 data structure is allocated using devm and contains a work item scheduled by report handlers from device input,...

CVE-2026-64250

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Report dying CPU to RCU in stopthiscpu This is a port of MIPS commit 9f3f3bdc6d9dac1 "MIPS: smp: report dying CPU to RCU in stopthiscpu". smpsendstop parks all secondary CPUs in stopthiscpu. And the function marks the...