CVE-2026-19936: Concurrent Execution using Shared Resource with Improper Synchronization

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayablemsg.c shares three intrusive lists busyctx, freectx, freechunks and one kworkdelayable between two cooperative threads with no synchronization: btmeshdelayablemsgmanage runs on the Bluetooth host RX thread,...

CVE-2026-19936 Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayablemsg.c shares three intrusive lists busyctx, freectx, freechunks and one kworkdelayable between two cooperative threads with no synchronization: btmeshdelayablemsgmanage runs on the Bluetooth host RX thread,...

PT-2026-83952

The I3C IBI subsystem in drivers/i3c/i3c ibi workq.c hands out statically-allocated work nodes through a free-list i3c ibi work nodes free implemented as a plain sys slist t, which provides no synchronization. The allocation helpers i3c ibi work enqueue, i3c ibi work enqueue target irq, i3c ibi...

CVE-2022-50100

CVE-2022-50100 affects the Linux kernel sched/core: Do not requeue a task on a CPU excluded from cpus_mask. The issue arises from a ttwu wakeup optimization that could queue a task on the wrong CPU, triggering an early-boot warning on large machines. The commit c6e7bd7afaeb implements a fix by en...