CVE-2026-49428

Certain system calls, such open2 with the OTRUNC flag set, and fspacectl2, could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel...

CVE-2026-49421

The kernel function that implements unlinkat2 and funlinkat2 validated the ATRESOLVEBENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, so path resolution was not actually restricted. A process that uses ATRESOLVEBENEATH with unlinkat2 or...

CVE-2026-49428

In FreeBSD's posixshm module, open(2) with O_TRUNC and fspacectl(2) failed to verify whether operations are permitted on largepage objects, incorrectly freeing kernel memory. An unprivileged local user can read freed kernel memory and escalate privileges. Affected: all supported versions prior to...

CVE-2026-49427

CVE-2026-49427 is a use-after-free vulnerability in FreeBSD's POSIX largepage shared memory objects (posixshm module). Pages in largepage objects were not explicitly wired, so when sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed underlying pages while existing mappings s...

CVE-2026-49422 Use-after-free in TCP RACK stack option handler

The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace...

CVE-2026-49422 Use-after-free in TCP RACK stack option handler

The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace...

CVE-2026-49421 unlinkat(2) ignores AT_RESOLVE_BENEATH flag

The kernel function that implements unlinkat2 and funlinkat2 validated the ATRESOLVEBENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, so path resolution was not actually restricted. A process that uses ATRESOLVEBENEATH with unlinkat2 or...

CVE-2026-49421

CVE-2026-49421 affects the FreeBSD kernel in all supported versions. The kernel function implementing unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pass it to the underlying path lookup, silently dropping it. As a result, path resolution is not actually confined...

CVE-2026-49418

When msyncMSINVALIDATE is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the object's list. This corrupts the list, a...

CVE-2026-72326

A flaw was found in the Linux kernel's CAKE Common Applications Kept Enhanced packet scheduler. This vulnerability arises from the incorrect handling of signed overhead values, which can lead to an integer underflow during packet length calculations. A negative effective length can then wrap to a...

CVE-2026-72321

A flaw was found in the Linux kernel's IPv4 Internet Group Management Protocol IGMP component. Incorrect handling of reference counts in the igmpmodtimer and igmpstoptimer functions can occur when a multicast list entry is concurrently removed. This can lead to a memory leak of the im structure,...

CVE-2026-72316

A flaw was found in the Linux kernel's device mapper dm era target. When the metadataopen function fails to allocate memory, it returns a NULL pointer. The calling function, eractr, does not correctly validate this return, leading to a NULL pointer dereference when the metadata is accessed. This...

CVE-2026-72315

A flaw was found in the Linux kernel's SMB client cifs. This issue occurs due to a delayed release of dentry reference counts during direct I/O DIO operations. When a file system is unmounted while these operations are still pending, it can lead to a "busy dentry" warning. This prevents the...

CVE-2026-72313

A flaw was found in the Linux kernel's display rendering manager DRM framebuffer helper drm/fb-helper. This vulnerability arises from incorrect synchronization with display controllers CRTCs, where the system attempts to synchronize with an inactive controller. This can lead to display timeouts a...

CVE-2026-72307

A flaw was found in the Linux kernel's mlxsw driver. When the mlxswspvrslpmtreereplace function encounters an error during Virtual Router VR replacement operations, its rollback mechanism fails to correctly release resources. This leads to a reference count leak, where system resources are not...

CVE-2026-72275

A flaw was found in the Linux kernel's fbdev broadsheetfb component. This issue arises when memory allocated for page references is not properly released during an error in the broadsheetfbprobe function. This oversight could lead to a memory leak, potentially allowing a local attacker to cause...

CVE-2026-72273

A flaw was found in the Linux kernel's efifb framebuffer driver. A memory leak occurs in the efifbprobe function because a string returned from fbgetoptions is not properly freed after use. This can lead to a gradual consumption of system memory, potentially impacting system stability and...

CVE-2026-72272

A flaw was found in the Linux kernel. Improper memory deallocation in the radeonfbpciregister function within the fbdev: radeon driver can lead to a memory leak. A local user could potentially exploit this flaw, causing the system to consume excessive memory resources, which may result in a Denia...

CVE-2026-72266

A flaw was found in the fbdev: vesafb component of the Linux kernel. A memory leak occurs in the vesafbprobe function because a string returned from fbgetoptions is not properly freed. This oversight can lead to resource exhaustion, potentially resulting in a Denial of Service DoS for the system...

CVE-2026-72260

A flaw was found in the Advanced Linux Sound Architecture ALSA System on Chip ASoC Mediatek MT8192 audio driver in the Linux kernel. During the device probe process, the driver fails to properly check the return value of a runtime power management PM function. If the runtime resume operation fail...