kernel: rxrpc: Fix potential UAF after skb_unshare() failure

A flaw was found in the Linux kernel's rxrpc subsystem. This vulnerability arises when the system attempts to unshare a packet buffer, and the operation fails due to an allocation issue. This failure can lead to a Use-After-Free UAF condition, where the system attempts to access memory that has...

UBUNTU-CVE-2026-72458

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix NULL pointer dereference in unpackpdb pdb-dfa could be NULL if unpackdfa fails, causing a NULL pointer dereference...

CVE-2026-74370

The CVE-2026-74370 issue affects the Linux kernel and is resolved by a liveupdate fix for a TOCTOU race in luo_session_retrieve(). The root cause was a race between the lookup and the session mutex where a thread could release and free the session; the patch extends the scope of the rwsem_read lo...

CVE-2026-72442

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix and simplify IP6IP6 tunnel handling Fix nfflowip6tunnelproto to use pskbmaypull instead of skbheaderpointer to ensure the outer IPv6 header is in the skb headroom, which is required for subsequent packet...

CVE-2026-72441

In the Linux kernel, the following vulnerability has been resolved: ieee802154: fix kernel-infoleak in dgramrecvmsg KMSAN reported a kernel-infoleak in moveaddrtouser: BUG: KMSAN: kernel-infoleak in instrumentcopytouser include/linux/instrumented.h:131 inline BUG: KMSAN: kernel-infoleak in...

CVE-2026-72347

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtconnmark: reject invalid shift parameters Revision 2 of the CONNMARK target accepts user-controlled shift parameters and applies them to 32-bit mark values in connmarktgshift. A shiftbits value of 32 or more triggers...

CVE-2026-72208

In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfsealookup and ntfslistxattr, this verifies that there is enough space in the EA entry before accessing the nextentryoffset field of the EA entry...

CVE-2026-72178

CVE-2026-72178 relates to the Linux kernel, specifically the DAMON subsystem (mm/damon/core). The issue: during damon_commit_target(), destination and source target pids are not consistently managed when a commit fails, which could leak pids if the destination context lacks the necessary cleanup ...

CVE-2026-72066

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Bound hotplug states sysfs output statesshow adds CPU hotplug state names into a single sysfs buffer using sprintf. With enough registered states, this can write past the end of the PAGESIZE buffer. Use sysfsemitat ...

CVE-2026-72059

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure t7xxcldmalateinit creates mdctrl-gpddmapool before initializing the TX and RX rings. If any ring initialization fails, the error path frees the already initialized ring...

PT-2026-72544

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs issue read Fix missing release of credits in the failure path in cifs issue read lest retrying the subreq just overwrites the credits value...

USN-8630-1: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - InfiniBand drivers; - Network drivers; - Mellanox network drivers; - File systems infrastructur...

UBUNTU-CVE-2026-68357

In the Linux kernel, the following vulnerability has been resolved: watchdog: pretimeout: Fix UAF in watchdogunregistergovernor When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to defaultgov. If the governor being...

UBUNTU-CVE-2026-68173

In the Linux kernel, the following vulnerability has been resolved: ublk: wait on ublkdevready instead of ub-completion ub-completion is only re-armed by a successful STARTUSERRECOVERY. If the ublk server sends ENDUSERRECOVERY without one - e.g. its START failed with -EBUSY and the error was...

CVE-2026-68299

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

CVE-2026-58632 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

...

CVE-2026-58632

CVE-2026-58632 is a Windows Win32K use-after-free vulnerability in the Win32 Kernel Subsystem that could allow a locally authenticated attacker to escalate privileges. The CVE is described as a local elevation of privilege (no remote code execution). Public sources in the connected set consistent...

CVE-2026-58632 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

...

Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm: Do not allow userspace to trigger kernel warnings in drmgemchangehandleioctl Since GEM bo handles are of type u32 in the uapi, and the internal implementation uses idralloc, which uses integer ranges. Passing a new handle th...