CVE-2026-68318

A flaw was found in the pdscore component of the Linux kernel. This use-after-free vulnerability occurs because the workqueue is destroyed prematurely during the pdscremove operation, before pdscteardown completes. This timing issue allows for work to be queued on an already destroyed workqueue,...

UBUNTU-CVE-2026-68203

In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix cleanup bugs in vividinit When platformdeviceregister fails in vividinit, the embedded struct device in vividpdev has already been initialized by deviceinitialize, but the failure path jumps to freeoutputstrings...

CVE-2026-68382

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown completes GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock...

CVE-2026-68367

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: synchronize delayed setalt with teardown The ftcm setalt path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses ftcm private state and ma...

CVE-2026-68414 wifi: cfg80211: cancel sched scan results work on unregister

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work on unregister cfg80211schedscanresults can queue rdev-schedscanreswk from a driver result notification while a scheduled scan request is present. The work callback recovers the...

EUVD-2026-55589

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls...

CVE-2026-68403 wifi: brcmfmac: initialize SDIO data work before cleanup

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls...

CVE-2026-68382 drm/xe/guc: Hold device ref until queue teardown completes

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown completes GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock...

CVE-2026-68382

Summary: In the Linux kernel DRM/XE/GuC path, destruction of the GuC exec queue could race with cleanup, risking deadlock when the final device put happens from a destroy worker. What’s affected: drm/xe/guc components in the Linux kernel; behavior updated across multiple v2–v12 revisions to fix q...

CVE-2026-68382 drm/xe/guc: Hold device ref until queue teardown completes

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown completes GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock...

CVE-2026-68363

The CVE affects the Linux kernel ath9k wireless driver (ath9k_htc) in the hif_usb path. The vulnerability arises when an asynchronous firmware load is re-armed via request_firmware_nowait(), which passes hif_dev as the completion context and later dereferences hif_dev in a post-request dev_info()...

EUVD-2026-55420

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix deadlock between reset thread and remove pciresetfunction acquires devicelock before performing the reset. pdscremove is called by the PCI core with devicelock already held. If pdscpciresetthread is running when...

CVE-2026-68319

The CVE-2026-68319 entry concerns Linux kernel code where a deadlock could occur between the PCI reset thread and removal path. The root cause was that pci_reset_function() acquires device_lock, and pdsc_remove() is invoked with that lock held; if the reset thread is active, destroy_workqueue() b...

CVE-2026-68318

The CVE-2026-68318 entry concerns a Linux kernel use-after-free in pds_core during remove, caused by destroying the workqueue before pdsc_teardown() completes. The issue allows queued work on a destroyed workqueue via two paths: (1) a timeout in pdsc_teardown() -> pdsc_devcmd_reset() causes he...

EUVD-2026-55419

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix use-after-free on workqueue during remove In pdscremove, the workqueue is destroyed before pdscteardown is called. This ordering allows two paths to queue work on the destroyed workqueue: 1. If pdscteardown -...

CVE-2026-68218

The CVE affects the Linux kernel driver for the media: pci: dm1105 component. The root cause is a memory leak caused by not destroying the allocated workqueue; the fix is to destroy the allocated workqueue in the remove() callback to free resources. Impact is memory leak risk; remediation is a ke...

EUVD-2026-55319

In the Linux kernel, the following vulnerability has been resolved: media: pci: dm1105: Free allocated workqueue Destroy allocated workqueue in remove callback to free its resources, thus fixing memory leak...

EUVD-2026-55304

In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix cleanup bugs in vividinit When platformdeviceregister fails in vividinit, the embedded struct device in vividpdev has already been initialized by deviceinitialize, but the failure path jumps to freeoutputstrings...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: qat – Flushes misc workqueue during device shutdown Repeated loading and unloading of a device-specific QAT driver, such as qat4xxx, in a tight loop can lead to a crash due to a use-after-free scenario. This occurs when a...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: usb:dwc3:gadget: Move vbus draw to workqueue context Currently, dwc3gadgetvbusdraw can be called from an atomic context, which in turn invokes APIs from power-supply-core. Some of these PMIC APIs have operations that may enter a...