CVE-2026-64582

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxemmap rxemmap removes a rxemmapinfo struct from the pendingmmaps list and releases pendinglock while the struct's kref is still at 1: listdelinit&ip-pendingmmaps;...

Linux kernel 6lowpan: NHC entry use-after-free on error path

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

TencentOS Server 4: kernel (TSSA-2026:0708)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0708 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

CVE-2026-64544

In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - fix OOB read in pefiledigestpecontents pefiledigestpecontents computes the trailing-data hash length as pelen - hashedbytes + certssize. A crafted PE can make the addition exceed pelen, causing the unsign...

CVE-2026-64540

In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelinkrxfixup genelinkrxfixup splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by...

CVE-2026-64539

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eircreateadvdata builds the advertising data into a fixed-size buffer "size", 31 for the legacy path. It may prepend a 3-byte "Flags" AD structure LEADNOBREDR on an...

CVE-2026-64542

In the Linux kernel, the following vulnerability has been resolved: ipv6: ndisc: fix NULL deref in acceptuntrackedna acceptuntrackedna re-fetches the inet6dev with in6devgetdev and dereferences idev-cnf.acceptuntrackedna without a NULL check, even though its only caller ndiscrecvna already fetche...

CVE-2026-64546

In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drmparsetiledblock drmparsetiledblock casts the DisplayID block to a struct displayidtiledblock and reads the full fixed layout up to tile-topologyid7 without checking block-numbytes. The DisplayID...

CVE-2026-64554

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in brip6fragment brip6fragment gets prevhdr, a pointer into the skb head, from ip6find1stfragopt, then calls skbchecksumhelp. For a cloned skb skbchecksumhelp reallocates the head via...

CVE-2026-64554

CVE-2026-64554 affects the Linux kernel's Netfilter bridge path. The vulnerability occurs in br_ip6_fragment(), which obtains prevhdr (a pointer into the skb head) from ip6_find_1stfragopt() and then calls skb_checksum_help(). For cloned skbs, skb_checksum_help() reallocates the head via pskb_exp...

PT-2026-65225

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Qualcomm rmnet driver where the system fails to validate MAP frame length before ingress parsing when ingress deaggregation is disabled. In this scenario, the rmne...

PT-2026-65229

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free write occurs in the netfilter bridge component. The function br ip6 fragment obtains a pointer prevhdr to the socket buffer skb head via ip6 find 1stfragopt. When skb...

SUSE CVE-2026-64452

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

CVE-2026-64448

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc0 exemption to responses without data area smb2checkmessage has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received "server ca...

AZL-93545 CVE-2026-64434 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

CVE-2026-64431

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling postwritemstfixup for invalid indexblock ntfsicxibsyncwrite calls postwritemstfixup when ntfsibwrite returns an error, intending to restore the buffer after a failed write. However, ntfsibwrite returns an erro...

AZL-93455 CVE-2026-64424 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netpoll: fix a use-after-free on shutdown path There is a use-after-free error on netpoll, which is clearly detected by KASAN. BUG: KASAN: slab-use-after-free in rawspinlockirqsave+0x3b/0x80 Read of size 1 at addr ... by task...

AZL-93461 CVE-2026-64411 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before findtablelock updatecounters and compatupdatecounters forward a user-supplied 32-byte table name to findtablelock without NUL-terminating it. On a lookup miss, findinlistlock calls...

AZL-93536 CVE-2026-64406 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in btacceptdequeue btacceptget takes a temporary reference before dropping the accept queue lock. btacceptdequeue currently drops that reference before btacceptunlink, leaving only the queue reference...

CVE-2026-64347

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is selected: if cdev-config config = cdev-config; else config =...