CVE-2026-64466

CVE-2026-64466 affects the Linux kernel where, in the rust_binder component, a freeze listener may linger in the freeze_listeners red-black tree and the remote node’s listener list after the referenced object’s refcount reaches zero. This can create a refcount cycle and potentially a memory leak....

CVE-2026-64432

Summary: CVE-2026-64432 affects the Linux kernel, specifically the ntfs3 filesystem code path used during NTFS image replay. The issue stems from validating the Dirty Page Table (DPT) capacity in log_replay() when copying LCNs; if dp->lcns_follow (capacity) is smaller than lrh->lcns_follow,...

CVE-2026-64419 mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: do not hold RCU lock in shrinkerdebugfscountshow Reading the debugfs "count" file of a memcg-aware shrinker can sleep inside an RCU read-side critical section: BUG: sleeping function called from invalid context at...

EUVD-2026-48961

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinkerdebugfsadd creates both "count" and "scan" debugfs files unconditionally. That assumes every shrinker implements both countobjects and scanobjects, which is not...

CVE-2026-64417

CVE-2026-64417 is a NULL pointer dereference in the Linux kernel's shrinker debugfs subsystem. The function shrinker_debugfs_add() unconditionally creates both "count" and "scan" debugfs files, assuming every shrinker implements both count_objects() and scan_objects(). Shrinkers like xen-backend ...

CVE-2026-64417 mm: shrinker: fix NULL pointer dereference in debugfs

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinkerdebugfsadd creates both "count" and "scan" debugfs files unconditionally. That assumes every shrinker implements both countobjects and scanobjects, which is not...

CVE-2026-64417 mm: shrinker: fix NULL pointer dereference in debugfs

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinkerdebugfsadd creates both "count" and "scan" debugfs files unconditionally. That assumes every shrinker implements both countobjects and scanobjects, which is not...

CVE-2026-64370

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

CVE-2026-64345 usb: gadget: f_printer: take kref only for successful open

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fprinter: take kref only for successful open printeropen returns -EBUSY when the character device is already open, but it increments dev-kref regardless of the return value. VFS does not call -release for a failed...

CVE-2026-64344 USB: idmouse: fix use-after-free on disconnect race

In the Linux kernel, the following vulnerability has been resolved: USB: idmouse: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a...

CVE-2026-64343 USB: ldusb: fix use-after-free on disconnect race

In the Linux kernel, the following vulnerability has been resolved: USB: ldusb: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a kr...

CVE-2026-64341 USB: iowarrior: fix use-after-free on disconnect race

In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use ...

EUVD-2026-48884

In the Linux kernel, the following vulnerability has been resolved: USB: legousbtower: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 U...

CVE-2026-64322 udf: validate sparing table length as an entry count, not a byte count

In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udfloadsparablemap accepts a sparing table when sizeofst + le16tocpust-reallocationTableLen sb-sblocksize is false, i.e. it treats reallocationTableLen as a...

CVE-2026-64322

In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udfloadsparablemap accepts a sparing table when sizeofst + le16tocpust-reallocationTableLen sb-sblocksize is false, i.e. it treats reallocationTableLen as a...

CVE-2026-64322

Mode C: Normal. The CVE-2026-64322 issue affects the Linux kernel UDF handling of sparing tables. The problem is that udf_load_sparable_map() validated reallocationTableLen as a byte count, while code walks the sparing table as an array of 8-byte entries, leading to potential out-of-bounds reads ...

EUVD-2026-49034

In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udfloadsparablemap accepts a sparing table when sizeofst + le16tocpust-reallocationTableLen sb-sblocksize is false, i.e. it treats reallocationTableLen as a...

CVE-2026-64322 udf: validate sparing table length as an entry count, not a byte count

In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udfloadsparablemap accepts a sparing table when sizeofst + le16tocpust-reallocationTableLen sb-sblocksize is false, i.e. it treats reallocationTableLen as a...

EUVD-2026-49030

In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the ppcount scan to the ppe array aixpartition reads the physical volume descriptor into a fixed-size struct pvd and then scans its physical-partition-extent array: int numpps = be16tocpupvd-ppcount; ... fo...

CVE-2026-64318

Summary (CVE-2026-64318) : In the Linux kernel, the partitions code for AIX on the PPC/IBM layout could read past the end of the ppe[] array. The function aix_partition() loads a fixed-size pvd and iterates up to the on-disk pp_count, which could exceed the allocated 1016 entries, leading to pote...