https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 19:50:57 +0000 https://vulnerability.circl.lu/vuln/cve-2026-97600 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ieee802154: cc2520: fix FIFOP work use-after-free</p> <p>The FIFOP interrupt handler queues cc2520_fifop_irqwork. On removal, cc2520_remove() only flushes the work. The devm-managed FIFOP IRQ remains active until after -&gt;remove() returns and can queue the work again after that flush, allowing it to run after the private data is released.</p> <p>Disable the work with disable_work_sync() instead of flushing it, so the handler can no longer queue it once removal begins. Destroy the buffer mutex last, since the worker and the stop callback invoked through ieee802154_unregister_hw() both take it.</p> <p>Found by an in-house static analysis tool.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ieee802154: cc2520: fix FIFOP work use-after-free</p> <p>The FIFOP interrupt handler queues cc2520_fifop_irqwork. On removal, cc2520_remove() only flushes the work. The devm-managed FIFOP IRQ remains active until after -&gt;remove() returns and can queue the work again after that flush, allowing it to run after the private data is released.</p> <p>Disable the work with disable_work_sync() instead of flushing it, so the handler can no longer queue it once removal begins. Destroy the buffer mutex last, since the worker and the stop callback invoked through ieee802154_unregister_hw() both take it.</p> <p>Found by an in-house static analysis tool.</p> https://vulnerability.circl.lu/vuln/cve-2026-97600