Tagged “cve.org”
CVEs tagged cve.org, newest first.
50026 CVEsRSS
CVE-2026-98750Medium· 4.7tty: fix saved termios reset race
In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device an…
CVE-2026-98749Medium· 4.7tty: serial: max3100: shut down timer before freeing port
In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100_shutdown() stops the polling timer but returns early during system suspend. If the SPI device is unbo…
CVE-2026-98748Medium· 4.1serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
In the Linux kernel, the following vulnerability has been resolved: serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() brcmuart_handle_irq() starts priv->hrt to work around a receive-timeout quirk of the 8250 core when hardw…
CVE-2026-98754High· 7.0tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup vcc_cleanup() sets port->tty to NULL without holding port->lock, racing with vcc_event() LDC callback…
CVE-2026-98753Medium· 4.7tty: tty_port: restore TTY_IO_ERROR on activation failure
In the Linux kernel, the following vulnerability has been resolved: tty: tty_port: restore TTY_IO_ERROR on activation failure Make sure to restore the TTY_IO_ERROR flag if activation fails to prevent I/O attempts on a port that is gone…
CVE-2026-98751Medium· 5.5tty: abort break signalling on hangup
In the Linux kernel, the following vulnerability has been resolved: tty: abort break signalling on hangup The break ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Dr…
CVE-2026-98757Medium· 4.1usb: cdns3: fix use-after-free in cdns3_gadget_exit()
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3_gadget_exit() cdns3_gadget_start() arms two works on system_freezable_wq: pending_status_wq for the deferred ep0 status stage a…
CVE-2026-98752Medium· 4.7tty: port: fix tty_port_tty_vhangup() race
In the Linux kernel, the following vulnerability has been resolved: tty: port: fix tty_port_tty_vhangup() race Drivers rely on tty_port_tty_vhangup() to synchronously hang up their ports before tearing down resources as part of deregis…
CVE-2026-98759Medium· 6.8kernel: usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work() (CVE-2026-98759)
A flaw was found in the Linux kernel's USB Type-C TI Power Delivery (tipd) driver. The driver fails to initialize memory for descriptor structures when handling partner device connections. An attacker connecting a USB device can cause the …
CVE-2026-98758Medium· 4.1kernel: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (CVE-2026-98758)
A flaw was found in the Linux kernel's USB Type-C Connector System Software Interface (UCSI) GLINK driver. A local attacker with administrative privileges could trigger this flaw during device removal, leading to a Denial of Service (DoS) …
CVE-2026-98756Medium· 4.1usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver d…
CVE-2026-98755Low· 3.3tty: vcc: zero-initialize control packet in vcc_send_ctl()
In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vcc_send_ctl() The stack-allocated struct vio_vcc pkt was partially initialized, leaving the tag.stype_env field uninitiali…
CVE-2026-98765Medium· 4.1USB: gadget: dummy-hcd: Fix wait for outstanding request completions
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronize_irq() by waiting until its private callback_usage counte…
CVE-2026-98761Medium· 4.0usb: typec: tcpm: recover after failure to start the frs ams
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: recover after failure to start the frs ams Reset the port if the tcpm fails to start the FAST_ROLE_SWAP AMS by initiating error recovery on it. This…
CVE-2026-98760Medium· 6.1usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() tps6598x_connect() passes a stack-allocated typec_partner_desc to typec_register_partner()…
CVE-2026-98766Medium· 4.1usb: gadget: aspeed-vhub: cancel wake work on device removal
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed-vhub: cancel wake work on device removal wake_work is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is never …
CVE-2026-98763Medium· 6.2usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both ep_in and ep_out for non-ep0 control endpoints In usb_enable_endpoint(), non-zero control endpoints (where usb_endpoint_xfer_control(&ep->desc) i…
CVE-2026-98762Medium· 4.7USB: dwc2: shut down wakeup timer before freeing HCD state
In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup timer before freeing HCD state dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2_hcd_free() current…
CVE-2026-98768Medium· 4.7usb: typec: anx7411 - stop the IRQ before destroying the workqueue
In the Linux kernel, the following vulnerability has been resolved: usb: typec: anx7411 - stop the IRQ before destroying the workqueue The IRQ is devm-managed, so it can still queue plat->work while remove() is tearing the queue down. …
CVE-2026-98767Medium· 5.1usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: fix IRQ storm on invalid event buffer count When dwc3_check_event_buf() reads a GEVNTCOUNT value exceeding the event buffer length, commit 63ccd26cd…
CVE-2026-98764Medium· 4.4usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC When user space sets up FunctionFS with only full-speed descriptors (e.g., flags = FUNCTION…
CVE-2026-98770Medium· 4.4kernel: usb: gadget: midi2: Fix the jack descriptor array sizes (CVE-2026-98770)
A flaw was found in the Linux kernel's USB gadget MIDI 2.0 driver. Under-sized descriptor arrays allow a local user to trigger an out-of-bounds memory access when setting up a large number of MIDI jacks through the configuration filesystem…
CVE-2026-98769High· 8.4usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd generic_set_cmd() and generic_get_cmd() use the low nibble of ctrl->bRequest as an index i…
CVE-2026-98774Low· 3.3kernel: rust_binder: cancel deferred work items in thread exit (CVE-2026-98774)
A flaw was found in the Linux kernel's Rust Binder driver. When a thread terminates while handling an active outgoing transaction, deferred work items on the thread's task list are not properly cleaned up during thread release. A local att…
CVE-2026-98772Medium· 4.7USB: serial: fix port tear down use-after-free
In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix port tear down use-after-free Some drivers for multiport devices access port driver data from completion handlers of shared URBs submitted at attach()…
CVE-2026-98771Low· 3.3usb: storage: sierra_ms: reject short SWoC info transfers
In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierra_ms: reject short SWoC info transfers sierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes from the device via usb_control_msg(), bu…
CVE-2026-98776Medium· 4.7kernel: kernel: Privilege escalation via binderfs use-after-free (CVE-2026-98776)
A flaw was found in the Linux kernel's Android Binder filesystem (binderfs). A local user can exploit a race condition during concurrent device creation and deletion to trigger a use-after-free (UAF) condition, which occurs when freed memo…
CVE-2026-98775Medium· 5.5nitro_enclaves: fix use-after-free on SLOT_ALLOC failure
In the Linux kernel, the following vulnerability has been resolved: nitro_enclaves: fix use-after-free on SLOT_ALLOC failure When ne_create_vm_ioctl() fails the SLOT_ALLOC request after anon_inode_getfile() has succeeded, the error pat…
CVE-2026-98773Medium· 4.7USB: cdc-acm: skip URB restart in port_shutdown if disconnected
In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in port_shutdown if disconnected acm_port_shutdown() is called from the tty-port machinery whenever the last user closes the port. acm_…
CVE-2026-98779Low· 1.9drm/amdgpu: fix ACP MFD device leak on init failure
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ACP MFD device leak on init failure acp_hw_init() registers ACP child devices with mfd_add_devices() before attaching them to the ACP power domain and …