2180 matches found
CVE-2026-72123
In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rxop deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 "can: bcm: use callrcu instead of costly synchronizercu" replaced synchronizercu in bcmdeleterxop with callrcu and introduced the RXNOAUTOTIME...
CVE-2026-72109
In the Linux kernel, the following vulnerability has been resolved: net: sparx5: unregister blocking notifier on init failure sparx5registernotifierblocks registers the switchdev blocking notifier before allocating the ordered workqueue. If the workqueue allocation fails, the error path unregiste...
UBUNTU-CVE-2026-72123
In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rxop deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 "can: bcm: use callrcu instead of costly synchronizercu" replaced synchronizercu in bcmdeleterxop with callrcu and introduced the RXNOAUTOTIME...
CVE-2026-72123
In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rxop deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 "can: bcm: use callrcu instead of costly synchronizercu" replaced synchronizercu in bcmdeleterxop with callrcu and introduced the RXNOAUTOTIME...
UBUNTU-CVE-2026-72109
In the Linux kernel, the following vulnerability has been resolved: net: sparx5: unregister blocking notifier on init failure sparx5registernotifierblocks registers the switchdev blocking notifier before allocating the ordered workqueue. If the workqueue allocation fails, the error path unregiste...
CVE-2026-72109
In the Linux kernel, the following vulnerability has been resolved: net: sparx5: unregister blocking notifier on init failure sparx5registernotifierblocks registers the switchdev blocking notifier before allocating the ordered workqueue. If the workqueue allocation fails, the error path unregiste...
CVE-2026-72005
In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00libprobedev uses the full rt2x00libremovedev teardown for all probe failures. However, drvdata allocation and workqueue allocation can fail before intfwork,...
UBUNTU-CVE-2026-72005
In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00libprobedev uses the full rt2x00libremovedev teardown for all probe failures. However, drvdata allocation and workqueue allocation can fail before intfwork,...
CVE-2026-72005
In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00libprobedev uses the full rt2x00libremovedev teardown for all probe failures. However, drvdata allocation and workqueue allocation can fail before intfwork,...
CVE-2026-74437
In the Linux kernel, CVE-2026-74437 affects the media: uvcvideo path. The vulnerability arises when a UVC camera with an asynchronous control triggers a path where uvc_status_stop is called from within async_ctrl.work, leading to a potential deadlock: cancel_work_sync waits for uvc_ctrl_status_ev...
CVE-2026-74437 media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix deadlock if uvcstatusstop is called from asyncctrl.work If a UVC camera has an asynchronous control, uvcstatusstop may be called from asyncctrl.work: uvcctrlstatuseventwork uvcctrlstatusevent uvcctrlclearhand...
CVE-2026-74437 media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix deadlock if uvcstatusstop is called from asyncctrl.work If a UVC camera has an asynchronous control, uvcstatusstop may be called from asyncctrl.work: uvcctrlstatuseventwork uvcctrlstatusevent uvcctrlclearhand...
CVE-2026-72405 net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
In the Linux kernel, the following vulnerability has been resolved: net: udptunnel: prevent double queueing in udptunnelnicdevicesync Yue Sun reported a use-after-free and debugobjects warning in udptunnelnicdevicesyncwork during concurrent device operations. The workqueue core clears the interna...
CVE-2026-72405
The CVE-2026-72405 issue affects the Linux kernel’s net/udp_tunnel path, specifically udp_tunnel_nic_device_sync_work() and related workqueue handling. A concurrent operation could queue work twice; when the active worker clears the work_pending flag, it could reset it for the newly queued item, ...
EUVD-2026-59304
In the Linux kernel, the following vulnerability has been resolved: net: udptunnel: prevent double queueing in udptunnelnicdevicesync Yue Sun reported a use-after-free and debugobjects warning in udptunnelnicdevicesyncwork during concurrent device operations. The workqueue core clears the interna...
CVE-2026-72405 net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
In the Linux kernel, the following vulnerability has been resolved: net: udptunnel: prevent double queueing in udptunnelnicdevicesync Yue Sun reported a use-after-free and debugobjects warning in udptunnelnicdevicesyncwork during concurrent device operations. The workqueue core clears the interna...
CVE-2026-72405 net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
In the Linux kernel, the following vulnerability has been resolved: net: udptunnel: prevent double queueing in udptunnelnicdevicesync Yue Sun reported a use-after-free and debugobjects warning in udptunnelnicdevicesyncwork during concurrent device operations. The workqueue core clears the interna...
CVE-2026-72342
The CVE-2026-72342 issue affects the Linux kernel’s net/mlx5e HV VHCA stats path. The race occurs in mlx5e_hv_vhca_stats_create() when publishing the stats agent via mlx5_hv_vhca_agent_create(): the agent is published and a delayed invalidation is scheduled before priv->stats_agent.agent and p...
EUVD-2026-59236
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpanenableset allocates a temporary work item and schedules doenableset on systemwq, then returns to debugfs. The debugfs active operation has ended at that point, but the worker...
CVE-2026-72337 Bluetooth: 6lowpan: avoid untracked enable work
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpanenableset allocates a temporary work item and schedules doenableset on systemwq, then returns to debugfs. The debugfs active operation has ended at that point, but the worker...