EUVD-2026-76675

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trustedtpmexit drops the TPM chip reference and frees the digest array before unregistering the trusted key type. keytypelookup holds keytypessem for reading until the key operation...

EUVD-2026-76419

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...

PT-2026-90470

In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk-action escaping walk pmd range If -pmd entry sets walk-action = ACTION AGAIN, the pmd none check is retried. The PMD entry may be cleared at the point of retry. In this case, if walk-ops-install pte is...

CVE-2026-80850 tcp: fix AO info use-after-free in tcp_ao_connect_init()

In the Linux kernel, the following vulnerability has been resolved: tcp: fix AO info use-after-free in tcpaoconnectinit tcpv4connect adds a SYN-SENT socket to the ehash before calling tcpconnect. If TCP-AO is configured, tcpconnect first verifies that a key matches the peer and the bound device's...

Linux Distros Unpatched Vulnerability : CVE-2026-80683

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via...

AZL-97782 CVE-2026-74743 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit neededheadroom and neededtailroom from lowerdev macvlan devices inherit hardheaderlen from lowerdev during macvlaninit, but leave neededheadroom and neededtailroom set to 0. When the underlying lowerdev requires...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Tunnels: Fixed the crash when generating IPV4 PMTU errors due to KASAN. If we attempt to emit an ICMP error in response to a non-linear SKB, we encounter the following issue: Bug: KASAN: Out-of-bounds access in...

Linux Distros Unpatched Vulnerability : CVE-2026-72408

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - geneve: gate GRO hint in genevegrocomplete on gs-grohint genevegroreceive reads the GRO hint through geneveskgrohintoff, which honours it only when the socket...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102132)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102132 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ignore explicit helper on new expectations Use the existing master conntrac...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101999)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101999 advisory. In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily...

Linux Distros Unpatched Vulnerability : CVE-2026-72478

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/ntfs3: add bounds check to rungethighestvcn rungethighestvcn parses a packed NTFS mapping- pairs buffer without any length bound, relying solely on a 0x00...

CVE-2026-74567 keys: fix out-of-bounds read in keyring_get_key_chunk()

In the Linux kernel, the following vulnerability has been resolved: keys: fix out-of-bounds read in keyringgetkeychunk For description-level chunks keyringgetkeychunk advances the read pointer by level sizeoflong past the inline prefix but only bounds-checks the prefix, so a long enough key...

CVE-2026-74509

The CVE applies to the Linux kernel Bluetooth HCI path for extended advertising. Root cause: hci_find_adv_instance() can return an adv_info pointer that remains valid only while hdev->lock is held, but advertisement data paths perform lookups without that lock and may retain the pointer while ...

CVE-2026-72493

In the Linux kernel, the following vulnerability has been resolved: net: serialize netifrunning check in enqueuetobacklog Syzbot reported a KASAN slab-use-after-free in fibruleslookup. The root cause is a race condition where packets can escape the backlog flushing during device unregistration...

UBUNTU-CVE-2026-72381

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistentid race the fp-owner.name compare-read in ksmbdvfscomparedurableowner against the kfr...

CVE-2026-72486

In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...

UBUNTU-CVE-2026-74357

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpucoredump ring dump The ring content dump in amdgpucoredump uses two separate loops over adev-rings: the first counts rings with unsignalled fences to size the allocation, and the...

CVE-2026-74310 vhost/net: complete zerocopy ubufs only once

In the Linux kernel, the following vulnerability has been resolved: vhost/net: complete zerocopy ubufs only once vhost-net initializes one ubufinfo per outstanding zerocopy TX descriptor and hands it to the backend socket. The networking stack may then clone a zerocopy skb before all skb referenc...

EUVD-2026-59377

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add bounds check to rungethighestvcn rungethighestvcn parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile UpdateMappingPairs record whose...

EUVD-2026-59307

In the Linux kernel, the following vulnerability has been resolved: geneve: gate GRO hint in genevegrocomplete on gs-grohint genevegroreceive reads the GRO hint through geneveskgrohintoff, which honours it only when the socket enabled IFLAGENEVEGROHINT gs-grohint. genevegrocomplete instead calls...