Linux Distros Unpatched Vulnerability : CVE-2026-74543

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: udptunnel: fix memory leak in udptunnelnicunregister syzbot reported a memory leak 1 in the UDP tunnel NIC offload code. When device registration fails e.g...

PT-2026-72537

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt rateest: fix u64 truncation in xt rateest mt On links faster than 34 Gbps, where byte rate may exceed 2^32-1 4.3 GBps, the comparison result becomes incorrect because the truncated value no longer reflects the actua...

PT-2026-72580

In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6: fix NULL deref in fib6 walk continue on multi-batch dump inet6 dump fib saves its progress in cb-args1 as a positional index within the current hash chain. Between batches, a concurrent fib6 new table can insert a new...

PT-2026-72998

In the Linux kernel, the following vulnerability has been resolved: hwmon: adt7470 Fix divide-by-zero TOCTOU crash in fan speed read If the fan data becomes 0 between the FAN DATA VALID check and the FAN PERIOD TO RPM conversion, it will result in a divide-by-zero crash due to a race with a...

Linux Distros Unpatched Vulnerability : CVE-2026-74405

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OPP: Fix race between OPP addition and lookup A race exists between devpmoppadddynamic and devpmoppfindfreqexact: CPU0 add CPU1 lookup...

PT-2026-72959

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidp get raw report waits for a numbered report, hidp process data compares the expected report number with skb-data0. A connected HIDP peer can reply with only a DATA...

PT-2026-72737

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix URB leak in alloc mtk intr urb error path When btmtk isopkt pad fails, the previously allocated URB is not freed, leaking the urb structure. Add usb free urb before returning the error...

PT-2026-72825

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix log flood after cmd mbox failure hns roce cmd mbox is the command interface between driver and hardware. When hardware is abnormal, the unlimited error printings after hns roce cmd mbox failure will cause log flood...

PT-2026-72960

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transaction header hidp recv ctrl frame and hidp recv intr frame read skb-data0 before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty...

PT-2026-72330

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 atomic SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic polling path rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next receive cycle has...

PT-2026-72304

In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op ifindex == 0 with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces:...

PT-2026-72303

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcm rx setup for RTR replies bcm tx setup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TX SETUP, but bcm rx setup never did the same for the RTR-reply frame...

PT-2026-72183

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211 mle common size uses the first common-info octet as the common information length for all known MLE types. However, ieee80211 mle size ok only validates that octet for...

PT-2026-72522

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISO END/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISO CONT, ISO END packets. We currently reject them if they are last. If controller sends malformed sequence ISO...

PT-2026-72472

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs Ignore KVM's internal "service pending PV EOI" request if the vCPU has disabled PV EOIs since the request was made. Asserting that PV EOIs are enabled can fai...

PT-2026-72653

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The out norqst exit in rpcrdma reply handler branches away before the credit clamp, so a reply that matches no pending request reaches out post carrying the raw credit value...

PT-2026-72606

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conncount: prevent connlimit drops for early confirmed ct Commit 69894e5b4c5e "netfilter: nft connlimit: update the count if add was skipped" introduced a regression where packets for valid connections are dropped...

PT-2026-72673

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresight add out conn increments nr outconns before calling devm krealloc array and again before devm kmalloc. If either allocation fails, the counter ...

PT-2026-72724

In the Linux kernel, the following vulnerability has been resolved: net: fib rules: Don't dump dying fib rule in fib rules dump. rocker router fib event calls fib rule get during RCU dump. If the fib rule is dying, refcount inc will complain about it. Let's call refcount inc not zero in fib rules...

PT-2026-72538

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt u32: reject invalid shift counts u32 match it executes rule-supplied shift operands on a 32-bit value. A malformed u32 rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during...