UBUNTU-CVE-2026-64211

In the Linux kernel, the following vulnerability has been resolved: srcu: Don't queue workqueue handlers to never-online CPUs While an srcustruct structure is in the midst of switching from CPU-0 to all-CPUs state, it can attempt to invoke callbacks for CPUs that have never been online. Worse yet...

UBUNTU-CVE-2026-64518

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix out-of-bounds access for twsk in tcpaoestablishedkey. lockdepsockisheld was added in tcpaoestablishedkey by the cited commit. It can be called from tcpv46timewaitack with twsk. Since it does not have sk-sklock, the lockd...

UBUNTU-CVE-2026-64515

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragmentation If either reconf or EPCS multi-link element MLE is contained in a non-transmitted profile, the defragmentation routine is called with a pointer to the defragmented copy, but the original...

PT-2026-64855

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Open vSwitch stores generated flow actions as nlattrs, which use a nla len field of type u16. A previous change allowed the total sw flow actions stream to exceed 64 KiB but removed the...

UBUNTU-CVE-2026-64517

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xegscinitposthwconfig explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup...

UBUNTU-CVE-2026-64522

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA mlx5exfrmaddstate handles acquire-flow temporary SAs by allocating software state and skipping hardware offload setup. That path jumps to the common success label...

UBUNTU-CVE-2026-64219

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which i...

UBUNTU-CVE-2026-64520

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Bound PARTITIONINFOGETREGS copies The register-based PARTITIONINFOGET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index...

UBUNTU-CVE-2026-64224

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix double free in rvureprsrcinit rvureprsrcinit allocates queue memory before calling otx2inithwresources. When hardware resource setup fails, otx2inithwresources already unwinds the partially initialized SQ, CQ, a...

UBUNTU-CVE-2026-64209

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config swingtbl and preemphasistbl are 4x4 arrays valid indices 0-3, but the boundary check uses " 4" instead of "= 4", allowing index 4 to cause an out-of-bounds...

Siemens SIMATIC S7-1500 CPU 1518 MFP Divide By Zero (CVE-2025-39681)

In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrlcpudetect in bspinit helper Since 923f3a2b48bd x86/resctrl: Query LLC monitoring properties once during boot resctrlcpudetect has been moved from common CPU initialization code to the...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Input Validation (CVE-2025-39827)

In the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in roseneigh refcount Current implementation maintains two separate reference counting mechanisms: the 'count' field in struct roseneigh tracks references from rosenode structures, while the 'us...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Input Validation (CVE-2025-39782)

In the Linux kernel, the following vulnerability has been resolved: jbd2: prevent softlockup in jbd2logdocheckpoint Both jbd2logdocheckpoint and jbd2journalshrinkcheckpointlist periodically release jlistlock after processing a batch of buffers to avoid long hold times on the jlistlock. However,...

Siemens SIMATIC S7-1500 CPU 1518 MFP Use After Free (CVE-2025-39691)

"In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bhread helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in endbufferreadsync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 by task swapper/3/0 CPU: 3 UID: 0 PID: 0 Com...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Input Validation (CVE-2025-38725)

In the Linux kernel, the following vulnerability has been resolved: net: usb: asixdevices: add phymask for ax88772 mdio bus Without setting phymask for ax88772 mdio bus, current driver may create at most 32 mdio phy devices with phy address range from 0x00 0x1f. DLink DUB-E100 H/W Ver B1 is such ...

UBUNTU-CVE-2026-64235

In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines With CONFIGCALLDEPTHTRACKING enabled on an x86 retbleed-affected platform eg: Skylake, with retbleed=stuff, registering a dynamic ftrace trampoline crashes on...

UBUNTU-CVE-2026-64524

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolutioncount and fix WIN8 fallback A SYNTHVIDRESOLUTIONRESPONSE with resolutioncount 64 walks past the supportedresolutionSYNTHVIDMAXRESOLUTIONCOUNT array in the parse loop. Bound resolutioncount against t...

UBUNTU-CVE-2026-64215

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xxhfisendperftable Check the return value of kzalloc to prevent a NULL pointer dereference on allocation failure. Patchwork: https://patchwork.freedesktop.org/patch/721342/...

CVE-2026-64220

In the Linux kernel, the following vulnerability has been resolved: device property: set fwnode-secondary to NULL in fwnodeinit If a firmware node is allocated on the stack for instance: temporary software node whose life-time we control or on the heap - but using a non-zeroing allocation functio...

Linux Distros Unpatched Vulnerability : CVE-2026-64517

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in...