CVE-2026-64432

A flaw was found in the Linux kernel's ntfs3 file system driver. A local attacker can exploit this vulnerability by mounting a specially crafted NTFS image. This can lead to a kernel slab out-of-bounds write during the $LogFile journal replay process, potentially causing a system crash or denial ...

CVE-2026-64435

A flaw was found in the Linux kernel's auditing subsystem. Multiple readers could access the auditqueue length qlen concurrently with a writer without proper synchronization, leading to a data race. This race condition could result in inconsistent data reads, potentially causing unpredictable...

CVE-2026-64449

A flaw was found in the Linux kernel's vmeuser module. This vulnerability allows a local user to cause a slab-out-of-bounds write or read due to improper validation of buffer sizes in the VME slave path. When a user-supplied VME window size exceeds the internal buffer, data can be copied beyond t...

CVE-2026-64328

A flaw was found in the Linux kernel's USB gadget subsystem. Specifically, a DMA Direct Memory Access fence leak exists in the ffs module's ffsdmabuftransfer function. This issue causes ffsdmafence objects to be allocated without their initial reference being properly released. Repeated...

CVE-2026-64557 Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2capsocknewconnectioncb l2capsocknewconnectioncb returned l2cappisk-chan after releasesockparent. Once the parent lock is dropped the newly enqueued child socket sk is reachable via the...

CVE-2026-64557

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2capsocknewconnectioncb l2capsocknewconnectioncb returned l2cappisk-chan after releasesockparent. Once the parent lock is dropped the newly enqueued child socket sk is reachable via the...

CVE-2026-64556 perf/core: Detach event groups during remove_on_exec

In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during removeonexec perfeventremoveonexec removes events by calling perfeventexitevent. For top-level events, this removes the event from the context with DETACHEXIT only. This can leave inconsisten...

CVE-2026-64556

In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during removeonexec perfeventremoveonexec removes events by calling perfeventexitevent. For top-level events, this removes the event from the context with DETACHEXIT only. This can leave inconsisten...

CVE-2026-64556

In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during removeonexec perfeventremoveonexec removes events by calling perfeventexitevent. For top-level events, this removes the event from the context with DETACHEXIT only. This can leave inconsisten...

CVE-2026-64556

CVE-2026-64556 pertains to the Linux kernel PMU subsystem (perf/core). When a performance event group leader is removed during process exit, its surviving siblings can remain active and still linked to the removed leader’s list, leaving the PMU context active list in a potentially inconsistent st...

CVE-2026-64556 perf/core: Detach event groups during remove_on_exec

In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during removeonexec perfeventremoveonexec removes events by calling perfeventexitevent. For top-level events, this removes the event from the context with DETACHEXIT only. This can leave inconsisten...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

CVE-2026-64520

A flaw was found in the Linux kernel's ARM Firmware Framework for ARM FFA. The PARTITIONINFOGETREGS function, which handles copying partition descriptors, did not adequately validate the indices provided by the firmware. This oversight could allow the system to process inconsistent data, resultin...

CVE-2026-64439

A flaw was found in the Linux kernel's Kerberos 5 krb5 cryptography module. This use-after-free vulnerability occurs when an asynchronous Authenticated Encryption with Associated Data AEAD instance is used. The system prematurely frees a memory buffer while a backend process still holds a pointer...

USN-8620-2: Linux kernel (Azure FIPS) vulnerabilities

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose...

USN-8620-2 linux-azure-fips vulnerabilities

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose...

CVE-2026-64259

A flaw was found in the Linux kernel's fuse-uring component. A local attacker could exploit a race condition by sending specially crafted requests before they are fully processed. This could lead to a use-after-free vulnerability, potentially allowing for arbitrary code execution or denial of...

CVE-2026-64516

A flaw was found in the Linux kernel's drm/amdgpu/vce1 component. The vulnerability arises from incorrect calculations of the VCE 1 firmware size and offsets, which could lead to an out-of-bounds access. This issue could potentially allow a local attacker to cause system instability or a denial o...

USN-8615-2: Linux kernel (Raspberry Pi) vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

USN-8615-2 linux-raspi, linux-raspi-5.4 vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...