CVE-2026-74528 Bluetooth: hci_sync: hold conn in hci_past_sync() callback

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...

UBUNTU-CVE-2026-72382

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

UBUNTU-CVE-2026-72130

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTHRECEIVE buffers nvmetexecuteauthreceive trusts the AUTHRECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, th...

UBUNTU-CVE-2026-72006

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: free mlx5stidxdata on final dealloc Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints e.g. churning RDMA MRs leak one struct mlx5stidxdata per cycle; kmemleak flags it as unreferenced...

CVE-2026-72343 net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation mlx5ehvvhcastatscreate is called from mlx5enicenable, before mlx5eopen. At that point priv-statsnch is still zero, because it is only ever incremented in...

CVE-2026-72192 ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...

EUVD-2026-58950

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...

CVE-2026-72006 net/mlx5: free mlx5_st_idx_data on final dealloc

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: free mlx5stidxdata on final dealloc Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints e.g. churning RDMA MRs leak one struct mlx5stidxdata per cycle; kmemleak flags it as unreferenced...

PT-2026-72908

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double free issue exists in the peak usb start function. When an RX URB transfer buffer is allocated using kmalloc and flagged with URB FREE BUFFER, the usb free urb function is design...

Linux Distros Unpatched Vulnerability : CVE-2026-74576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b mm/slab: avoid allocating slabobjext array from its own slab avoided...

CVE-2026-74528: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...

CVE-2026-74456: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: peakusbstart: fix double free of transfer buffer on URB submit error In peakusbstart, each RX URB transfer buffer is allocated with kmalloc and the URB is flagged URBFREEBUFFER so that the final usbfreeurb also free...

CVE-2026-74576: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobjext array from its own slab" avoided recursive allocation of objexts from kmalloc caches of the same...

PT-2026-73028

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the slab memory allocator where cycles can form between kmalloc caches of different sizes when allocating obj exts arrays used for memory allocation profiling and memc...

SUSE CVE-2026-68312

In the Linux kernel, the following vulnerability has been resolved: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths In cifsclosedeferredfile, cifsclosealldeferredfiles, and cifsclosedeferredfileunderdentry, when a pending deferred close is cancelled via...

CVE-2026-68312

In the Linux kernel, the following vulnerability has been resolved: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths In cifsclosedeferredfile, cifsclosealldeferredfiles, and cifsclosedeferredfileunderdentry, when a pending deferred close is cancelled via...

AZL-94953 CVE-2026-68312 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths In cifsclosedeferredfile, cifsclosealldeferredfiles, and cifsclosedeferredfileunderdentry, when a pending deferred close is cancelled via...

UBUNTU-CVE-2026-68312

In the Linux kernel, the following vulnerability has been resolved: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths In cifsclosedeferredfile, cifsclosealldeferredfiles, and cifsclosedeferredfileunderdentry, when a pending deferred close is cancelled via...

CVE-2026-68312

In the Linux kernel, the following vulnerability has been resolved: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths In cifsclosedeferredfile, cifsclosealldeferredfiles, and cifsclosedeferredfileunderdentry, when a pending deferred close is cancelled via...

CVE-2026-68312 cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths

In the Linux kernel, the following vulnerability has been resolved: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths In cifsclosedeferredfile, cifsclosealldeferredfiles, and cifsclosedeferredfileunderdentry, when a pending deferred close is cancelled via...