CVE-2026-74266

A flaw was found in the Linux kernel's schdualpi2 network scheduler. When the scheduler processes network packets, it can incorrectly manage its internal queue length. This mismanagement can lead to a system crash, making the system unavailable Denial of Service...

CVE-2026-72389

A flaw was found in the Linux kernel's bridge Spanning Tree Protocol STP module. A missing check in the brtopologychangedetection function allows a topology change timer to be armed while a bridge is administratively down. This can be exploited by an attacker to trigger a use-after-free...

CVE-2026-74269

A flaw was found in the bnxt driver, a component of the Linux kernel responsible for network card operations. This vulnerability involves a memory corruption issue that occurs during specific network data processing XDP head-grow operations. An underflow in the driver's code can lead to incorrect...

CVE-2026-66609

creationtimestamp| type| source ---|---|--- 2026-08-20 13:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtje4cvrcx2e 2026-08-20 14:08:11+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtjgagqgjv2m...

OESA-2026-3455 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: xfs: remove xfsattrleafhasname The calling convention of xfsattrleafhasname is problematic, because it returns a NULL buffer when xfsattr3leafread fails, a valid...

OESA-2026-3453 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel rfkillblock work in wiphyunregister There is a use-after-free error in cfg80211shutdownallinterfaces found by syzkaller: BUG: KASAN:...

kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot

A flaw was found in the Linux kernel's Server-Message-Block Direct SMC-D client. A remote attacker can exploit this vulnerability by sending a specially crafted SMC-Dv2 proposal with a Channel Identifier CHID of 0. This malicious proposal can cause a null pointer dereference in the kernel's SMC...

kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which i...

kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

A flaw was found in the Linux kernel's nfconntrackh323 helper. A remote attacker could exploit this by sending a specially crafted Q.931 SETUP message to port 1720 through a firewall with the nfconntrackh323 helper active. This memory corruption vulnerability leads to an out-of-bounds read, which...

kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size

A flaw was found in the Linux kernel's AMD display driver. This vulnerability occurs when the driver processes malformed VBIOS Video Basic Input/Output System data. Specifically, unvalidated register counts in the VBIOS can lead to an out-of-bounds memory write during the driver's initialization...

kernel: drm/i915: Fix potential UAF in TTM object purge

A flaw was found in the Linux kernel's Intel i915 graphics driver drm/i915. This use-after-free UAF vulnerability occurs during the TTM object purge operation. An attacker could potentially exploit this to cause a system crash, leading to a denial of service...

kernel: smb: client: validate DFS referral PathConsumed

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote attacker could send a specially crafted SMB response containing a malformed Distributed File System DFS referral. This could cause the PathConsumed value to exceed the search name length, leading to an out-of-bounds...

kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()

A flaw was found in the Linux kernel's drm/amdkfd component. An unprivileged local user can exploit an out-of-bounds write vulnerability in the kfdeventpageset function. This occurs because the function writes data without properly validating the buffer size, allowing a small buffer to trigger a...

kernel: memfd: deny writeable mappings when implying SEAL_WRITE

A flaw was found in the Linux kernel's memfd component. When the SEALEXEC flag is used to create a memory file descriptor, the SEALWRITE flag is implicitly applied to prevent writing to executable memory. However, this implicit write protection is applied after checks that should deny writable...

kernel: smb: client: fix double-free in SMB2_open() replay

A flaw was found in the Linux kernel's Server Message Block SMB client. A double-free vulnerability exists in the SMB2open replay mechanism. This occurs when a response-bearing attempt returns a replayable error and frees its response buffer, and then the cleanup process attempts to free the same...

kernel: smb: client: fix query_info() replay double-free

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error, occurs when the queryinfo replay mechanism attempts to free a response buffer that has already been released. This can happen if an error occurs during the initialization of an SMB2...

kernel: smb/client: handle overlapping allocated ranges in fallocate

A flaw was found in the Linux kernel's Server Message Block SMB client. The smb3simplefallocaterange function, which manages file allocation, can incorrectly process overlapping allocated ranges provided by a server. This can result in parts of a file not being properly zero-filled, leading to...

kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4

A flaw was found in the Linux kernel's AMD GPU amdgpu driver. Incorrect management of graphics memory dmafence references within the amdgpugemvaioctl function can lead to a reference count underflow and a use-after-after-free condition. A local attacker could exploit this vulnerability to trigger...

kernel: udf: fix partition descriptor append bookkeeping

A flaw was found in the Linux kernel's Universal Disk Format UDF filesystem. A remote attacker could exploit this vulnerability by tricking a user into mounting a specially crafted UDF image containing repeated partition descriptors. This could lead to a heap out-of-bounds write, potentially...

kernel: sched/psi: fix race between file release and pressure write

A flaw was found in the Linux kernel's Pressure Stall Information PSI subsystem. A race condition exists between the file release and pressure write operations, specifically concerning the priv member of struct kernfsopenfile. This can lead to a use-after-free vulnerability or a NULL dereference,...