EUVD-2026-48799

In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: Fix slab-use-after-free in chaoskeyrelease The chaoskey driver has a use-after-free bug in its release routine. If the user closes the device file after the USB device has been unplugged, a debugging log statement...

CVE-2026-64455 USB: chaoskey: Fix slab-use-after-free in chaoskey_release()

In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: Fix slab-use-after-free in chaoskeyrelease The chaoskey driver has a use-after-free bug in its release routine. If the user closes the device file after the USB device has been unplugged, a debugging log statement...

CVE-2026-64453

A use-after-free in the Linux kernel's usbio USB driver occurs during device disconnection. When usbio_disconnect() iterates the client list in reverse, auxiliary_device_uninit() can free the current struct usbio_client, causing the list_for_each_entry_reverse() iterator to dereference freed memo...

CVE-2026-64453 usb: misc: usbio: fix disconnect UAF in client teardown

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbiodisconnect walks usbio-clilist in reverse and uninitializes each auxiliary device. auxiliarydeviceuninit drops the device reference, and for an unbound child that can r...

CVE-2026-64447

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7isysinit and ipu7psysinit, pdata is allocated and then passed to ipu7businitializedevice, which stores it in adev-pdata. The ipu7busrelease...

EUVD-2026-48791

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7isysinit and ipu7psysinit, pdata is allocated and then passed to ipu7businitializedevice, which stores it in adev-pdata. The ipu7busrelease...

CVE-2026-64447 staging: media: ipu7: fix double-free and use-after-free in error paths

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7isysinit and ipu7psysinit, pdata is allocated and then passed to ipu7businitializedevice, which stores it in adev-pdata. The ipu7busrelease...

CVE-2026-64433

CVE-2026-64433 is a Use-After-Free in the Linux kernel's Bluetooth MGMT subsystem (net/bluetooth/mgmt.c). The function add_device_complete() calls hci_conn_params_lookup() and reads params->flags without holding hci_dev_lock, allowing a concurrent MGMT_OP_REMOVE_DEVICE to free the underlying o...

CVE-2026-64433 Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF of hciconnparams in adddevicecomplete adddevicecomplete runs from the hcicmdsyncwork kworker, which holds only hcireqsynclock and not hcidevlock. It calls hciconnparamslookup and then dereferences the...

CVE-2026-64433

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF of hciconnparams in adddevicecomplete adddevicecomplete runs from the hcicmdsyncwork kworker, which holds only hcireqsynclock and not hcidevlock. It calls hciconnparamslookup and then dereferences the...

CVE-2026-64427 HID: logitech-dj: Fix maxfield check in DJ short report validation

In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix maxfield check in DJ short report validation Commit b6a57912854e "HID: logitech-dj: Prevent REPORTIDDJSHORT related user initiated OOB write" added validation for the DJ short output report, but the error pa...

CVE-2026-64427

In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix maxfield check in DJ short report validation Commit b6a57912854e "HID: logitech-dj: Prevent REPORTIDDJSHORT related user initiated OOB write" added validation for the DJ short output report, but the error pa...

CVE-2026-64427

In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix maxfield check in DJ short report validation Commit b6a57912854e "HID: logitech-dj: Prevent REPORTIDDJSHORT related user initiated OOB write" added validation for the DJ short output report, but the error pa...

CVE-2026-64423

CVE-2026-64423 affects the Linux kernel IPv4 IGMP multicast handling. The root cause is that, when a device is destroyed, ip_mc_destroy_dev() decrements the multicast membership refcount but fails to unlink the membership from the device’s multicast hash table (mc_hash) before RCUs reclaim the ob...

CVE-2026-64423 ipv4: igmp: remove multicast group from hash table on device destruction

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64423 ipv4: igmp: remove multicast group from hash table on device destruction

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

EUVD-2026-48967

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64423

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64408

The CVE concerns the Linux kernel Bluetooth BNEP path: during netdev registration, bnep_add_connection() reads the L2CAP connection without holding the channel lock, and passes the HCI device to register_netdev() while a controller teardown could clear the connection. The published fix is to take...

CVE-2026-64400

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal bypass by restricting caseless retry ksmbdvfspathlookup enforces LOOKUPBENEATH to restrict path resolution within the share root. When a crafted path attempts to escape the share boundary using...