CVE-2026-98050

The Linux kernel contains a vulnerability in the mlxsw: spectrum_ptp component where mlxsw_sp1_ptp_ht_gc_collect() calls napi_gro_receive() from a PTP garbage-collection workqueue instead of the NAPI poll context. This leads to a race condition because the call mutates the NAPI instance's GRO lis...

CVE-2026-98050

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumptp: Fix napigroreceive call from GC workqueue context Currently mlxswsp1ptphtgccollect is run from the PTP garbage-collection workqueue, rather than the NAPI poll context. For any unmatched PTP entries carrying an...

Linux Distros Unpatched Vulnerability : CVE-2026-98050

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mlxsw: spectrumptp: Fix napigroreceive call from GC workqueue context Currently mlxswsp1ptphtgccollect is run from the PTP garbage-collection workqueue, rather...

kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

A flaw was found in the Linux kernel's NVMe over TCP nvmet-tcp implementation. When a data digest mismatch occurs, a reference count underflow can happen due to an unconditional cleanup call. This issue can lead to a use-after-free condition and ultimately result in a permanent workqueue deadlock...

CVE-2026-97409

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Do not cancel requests in io target before it is initialized A new nvme-fc controller in CONNECTING state sees admin request timeout schedules ctrl-ioerrwork to abort inflight requests. This ends up calling...

kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

A flaw was found in the Linux kernel's NVMe over TCP nvmet-tcp implementation. When a data digest mismatch occurs, a reference count underflow can happen due to an unconditional cleanup call. This issue can lead to a use-after-free condition and ultimately result in a permanent workqueue deadlock...

kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

A flaw was found in the Linux kernel's NVMe over TCP nvmet-tcp implementation. When a data digest mismatch occurs, a reference count underflow can happen due to an unconditional cleanup call. This issue can lead to a use-after-free condition and ultimately result in a permanent workqueue deadlock...

kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

A flaw was found in the Linux kernel's NVMe over TCP nvmet-tcp implementation. When a data digest mismatch occurs, a reference count underflow can happen due to an unconditional cleanup call. This issue can lead to a use-after-free condition and ultimately result in a permanent workqueue deadlock...

Linux Distros Unpatched Vulnerability : CVE-2026-90084

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - octeontx2-vf: fix workqueue and netdev race in probe/remove Initialize the VF workqueue before registernetdev so ndosetrxmode does not queue work on a NULL...

Linux Distros Unpatched Vulnerability : CVE-2026-90365

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: cancel reset and rc work on device unregister Both drivers cancelled dumpwork on unregister but left resetwork and rcwork to be flushed only by...

CVE-2026-90394

In the Linux kernel, the following vulnerability has been resolved: power: supply: sc2731charger: cancel work on remove The USB notifier and initial charger detection can schedule info-work. The remove path unregisters the notifier, but does not cancel queued or running work before the...

DEBIAN-CVE-2026-90331

In the Linux kernel, the following vulnerability has been resolved: HID: asus: refactor the two workqueues and init sequence Multiple issues have been found within the hid-asus driver: - unchecked size in asusrawevent - unclean teardown of asusprobe on failure - possible use-after-free in asuspro...

CVE-2026-90302

In the Linux kernel, the following vulnerability has been resolved: ocfs2: synchronize heartbeat callbacks with o2net teardown Patch series "ocfs2: harden heartbeat teardown races". This series fixes two OCFS2 heartbeat/o2net teardown races found by KASAN. This patch of 2: Heartbeat callbacks sta...

DEBIAN-CVE-2026-90084

In the Linux kernel, the following vulnerability has been resolved: octeontx2-vf: fix workqueue and netdev race in probe/remove Initialize the VF workqueue before registernetdev so ndosetrxmode does not queue work on a NULL workqueue. Unregister the netdev before destroying the workqueue, and add...

SUSE CVE-2026-89860

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Initialize NVMe abortwork once at submission qlanvmefcpabort and qlanvmelsabort ran INITWORK on priv-abortwork immediately before schedulework. INITWORK reinitializes the workstruct, resetting its list head and...

SUSE CVE-2026-89893

In the Linux kernel, the following vulnerability has been resolved: media: cx23885: cancel NetUP CI work before teardown netupciexit frees a netupcistate while its work item, netupreadcistatus, may still be pending or running on the system workqueue. The worker obtains the state with containerof...

EUVD-2026-82056

In the Linux kernel, the following vulnerability has been resolved: power: supply: isp1704charger: cancel work on remove The USB notifier and initial VBUS detection can schedule isp-work. The remove path unregisters the notifier and power supply, but does not wait for queued or running work befor...

EUVD-2026-81992

In the Linux kernel, the following vulnerability has been resolved: HID: asus: refactor the two workqueues and init sequence Multiple issues have been found within the hid-asus driver: - unchecked size in asusrawevent - unclean teardown of asusprobe on failure - possible use-after-free in asuspro...

CVE-2026-90173

A slab-use-after-free vulnerability in the Linux kernel's smbdirect driver (SMB over RDMA) is triggered when smbdirect_connection_destroy_qp() tears down completion queues with ib_destroy_cq() instead of ib_free_cq(). Because ib_destroy_cq() does not cancel the internal workqueue poll handler, a ...

CVE-2026-90084

CVE-2026-90084 affects the octeontx2-vf driver in the Linux kernel . A race condition exists in the probe/remove path: the VF workqueue was initialized after register_netdev(), meaning ndo_set_rx_mode could queue work on a NULL workqueue before initialization completed. The fix reorders the initi...