New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs

An unprivileged Linux program can time a hardware interrupt to land in the gap between a processor sanitizing its branch predictor and the kernel using it, re-poisoning the predictor after the defense has run. MIT CSAIL researchersDaniël Trujillo and Mengjia Yan named the technique INTERRUPT...

The vulnerabilities in the net/bluetooth/eir.c and net/bluetooth/mgmt.c modules of Linux kernel allow a hacker to cause a service failure.

The vulnerability in the net/bluetooth/eir.c and net/bluetooth/mgmt.c modules of Linux kernel systems relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a system failure...

CVE-2026-64572

A flaw was found in the Linux kernel's IPv4 forwarding information base FIB component. A local attacker with administrative network capabilities CAPNETADMIN could exploit a timing issue during route insertion and lookup operations. This could lead to a "use-after-free" vulnerability, where the...

CVE-2026-64578

A flaw was found in ksmbd, a Linux kernel module that provides an in-kernel SMB3 server. A remote attacker could exploit this vulnerability by crafting a malicious compound SMB2 request. This improper validation of the request size before reading specific data could lead to an out-of-bounds read,...

CVE-2026-64571

A flaw was found in the Linux kernel's wifi: p54 component. A local attacker with a malicious USB device could exploit this by sending a specially crafted frame during an EEPROM Electrically Erasable Programmable Read-Only Memory readback operation. This vulnerability allows the device to read...

CVE-2026-64566

A flaw was found in the Linux kernel's iptfs module, which handles network packet processing. When copying shared packet fragments, a critical flag indicating shared memory is not correctly propagated. This can lead to memory corruption within the kernel, potentially causing the system to crash a...

CVE-2026-64574

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. When new Wi-Fi links are added, an error in the update process can cause debugfs entries to point to memory that has already been freed. A local attacker can exploit this use-after-free vulnerability by accessing these dangling...

CVE-2026-64569

A flaw was found in the Linux kernel's Multiprotocol Label Switching MPLS subsystem. An unprivileged local user could send a specially crafted network message, leading to a null pointer dereference. This vulnerability could cause a system crash, resulting in a denial of service...

CVE-2026-64579

A flaw was found in the Linux kernel's xfrm policy component. An issue in the xfrmhashrebuild function, specifically with the preallocation of inexact policy bins, can lead to memory allocation failures under memory pressure. This failure can corrupt internal data structures, allowing a local...

ROOT-OS-UBUNTU-2204-CVE-2026-64405 CVE-2026-64405 in linux - Patched by Root

Root has patched CVE-2026-64405 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

EUVD-2026-53789

In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel-hid: Protect ACPI notify handler against recursion Since commit e2ffcda16290 "ACPI: OSL: Allow Notify handlers to run on all CPUs" ACPI notify handlers like the intel-hid notifyhandler may run on multiple CPU...

CVE-2026-64603

The CVE-2026-64603 entry describes a race condition in the Linux kernel's intel-hid platform/x86 ACPI notify_handler(). When two ACPI notify events race on different CPUs during lazy registration of the SW_TABLET_MODE input device (triggered from intel_hid_switches_setup()), both can bypass priv-...

CVE-2026-64602

The CVE describes a race condition in spear_adc_probe() for the Linux kernel IIO SPI driver: devm_request_irq() is called before st->completion is initialized, so an IRQ arriving early may call complete() on an uninitialized completion, dereferencing a NULL list entry and causing a kernel pani...

EUVD-2026-53788

In the Linux kernel, the following vulnerability has been resolved: iio: adc: spear: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "spearadcprobe in drivers/iio/adc/spearadc.c registers its interrupt handler with devmrequestirq before it initializes st-completion...

EUVD-2026-53787

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: captureurbcomplete: redundant usbanchorurb corrupts anchor list on each resubmission In captureurbcomplete, usbanchorurb is called on every completion callback, but the URB is already anchored from the initial...

CVE-2026-64601

CVE-2026-64601 affects the Linux kernel ALSA us144mkii capture path. In capture_urb_complete(), usb_anchor_urb() is called on every completion, but the URB is already anchored from the initial submission in tascam_trigger_start(). The redundant call corrupts the anchor doubly-linked list and infl...

EUVD-2026-53785

In the Linux kernel, the following vulnerability has been resolved: smb/client: Fix error code in smb2aeadreqalloc The "numsgs" variable is a u32 so "ERRPTRnumsgs" doesn't work. We would have to do something similar to the previous line where it's cast to int and then long. However, it's simpler ...

CVE-2026-64597

The CVE-2026-64597 is a Linux kernel SMB client issue describing a double-free in SMB2_close() during replay. The vulnerability occurs when a response-bearing attempt can return a replayable error and free its response buffer; if SMB2_close_init() fails before the next send, the cleanup reuses th...

CVE-2026-64596

CVE-2026-64596 affects the Linux kernel’s libfs handling. The vulnerability stemmed from init_pseudo() not setting SB_I_NOEXEC and SB_I_NODEV by default, allowing path_noexec() to warn when anonymous-inode files were mmap’d from certain superblocks. The fix sets both flags by default for every ps...

EUVD-2026-53783

In the Linux kernel, the following vulnerability has been resolved: libfs: set SBINOEXEC and SBINODEV by default in initpseudo Since commit 1e7ab6f67824 "anoninode: rework assertions", pathnoexec warns when an anonymous-inode file is mmap'd from a superblock that has not set SBINOEXEC. dma-buf...