CVE-2026-74522

A flaw was found in ksmbd, a component of the Linux kernel. This use-after-free vulnerability occurs when a ksmbd file object is prematurely freed while another session still holds a reference to it. This can lead to the system attempting to access freed memory, potentially causing a system crash...

CVE-2026-74520

A flaw was found in the Linux kernel's IOMMU Input/Output Memory Management Unit and IOMMUFD IOMMU File Descriptor components. This vulnerability is a Use-After-Free UAF, which means the system attempts to use memory that has already been released. Specifically, during device detachment or hardwa...

CVE-2026-74485

A flaw was found in the binfmtmisc component of the Linux kernel. An unprivileged local user, operating within a user namespace, could exploit this vulnerability. By registering a binfmtmisc string where the chosen delimiter character is also a flag character, the system's flag field parser can...

CVE-2026-74264

A flaw was found in the Linux kernel's network watchdog component. A race condition in the reference count tracking mechanism, specifically between netdevwatchdogup and devwatchdog, allows for concurrent overwriting or freeing of reference tracking information. This can lead to list corruption an...

CVE-2026-74547

A flaw was found in the Linux kernel's hwmon adt7470 component. A local user can exploit this by configuring the 'autoupdateinterval' to zero via sysfs while 'numtempsensors' is also set to zero. This combination forces the background thread into an unbounded busy-loop, consuming CPU resources an...

CVE-2026-74551

A flaw was found in the Linux kernel's hwmon: nzxt-smart2 driver. This vulnerability allows for immediate and deterministic memory corruption on systems with non-coherent CPU architectures, such as ARM or MIPS. When operations like setting a fan speed or updating an interval trigger a USB Direct...

CVE-2026-74541

A flaw was found in the Linux kernel's Bluetooth ISO subsystem. This vulnerability arises from the system's failure to properly clear isodata when a connection is detached from its host controller connection hcon. A local attacker could exploit this use-after-free condition to cause a denial of...

CVE-2026-74260

A flaw was found in the Linux kernel's netfilter component, specifically within the nfdupnetdev module. This vulnerability arises from an imbalanced decrementation of recursion counters when network packets are transmitted, particularly during a possible migration to a different CPU. This imprope...

CVE-2026-74259

A flaw was found in the Linux kernel's Common Internet File System CIFS implementation. A local user could trigger a null pointer dereference by unmounting a CIFS share while certain files are still being processed. This could lead to a system crash, resulting in a denial of service...

CVE-2026-74257

A flaw was found in the Linux kernel's sockmap feature. The udpbpfrecvmsg function, responsible for handling message reception, lacks proper serialization for skmsg objects. This allows multiple threads to access and modify the same skmsg object concurrently, resulting in a use-after-free...

CVE-2026-72502

A flaw was found in the Linux kernel. When processing TCP IPv6 packets with a large Maximum Transmission Unit MTU, a specific calculated Maximum Segment Size MSS value can conflict with an internal flag GSOBYFRAGS. A local attacker could send a specially crafted TCP packet that, when processed,...

CVE-2026-72500

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA Broadcom NetXtreme-E bnxtre driver. This use-after-free vulnerability occurs because a specific memory page is released prematurely during the teardown process. A local attacker could exploit this timing issue, potentially...

CVE-2026-74560

A flaw was found in the Linux kernel's AFXDP Address Family eXpress Data Path subsystem. When handling multi-buffer transmissions, the xskdropskb function incorrectly cancels completion queue CQ reservations without submitting buffer addresses to the CQ. This leads to a buffer leak where userspac...

CVE-2026-74486

A flaw was found in the Linux kernel's binfmtmisc component. This vulnerability arises from an inconsistency in how write access is managed for cloned interpreter files. When a pre-content watch is applied to an interpreter after its registration, subsequent executions through that entry can lead...

CVE-2026-72497

A flaw was found in the RDMA/bnxtre component of the Linux kernel. This vulnerability arises from insufficient validation of the Work Queue Entry WQE mode, which dictates how tasks are managed, against the hardware's defined slot limits. A local attacker could exploit this by supplying an invalid...

CVE-2026-72496

A flaw was found in the Linux kernel's RDMA/bnxtre component. When the bnxtqpliballocdpi function attempts to map I/O memory ioremap, it may not properly handle failures. This oversight could lead to system instability or a denial of service DoS condition, as the system might proceed with an...

CVE-2026-72494

A flaw was found in the Linux kernel's RDMA/irdma driver. The driver utilized a waitqueue and a requestdone flag for synchronization without adequate memory barriers. This oversight could lead to a race condition, potentially causing unpredictable system behavior or instability...

CVE-2026-74563

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS TCP module. The rdstcpladdrcheck function fails to hold the Read-Copy-Update RCU lock across an IPv6 address check. This allows a race condition where a network device can be freed while still being referenced, leading to a...

CVE-2026-74557

A flaw was found in the Linux kernel's libiscsi component. An incorrect bounds check in the iscsiscsicmdrsp function allows a malicious iSCSI target to craft a SCSI Response. This can lead to a read beyond the intended buffer, causing stale connection data to be copied into the SCSI sense buffer...

CVE-2026-74455

A flaw was found in the Linux kernel's peakusb Controller Area Network CAN driver. This vulnerability arises from insufficient validation of uCAN receive record lengths when processing data from a Universal Serial Bus USB receive buffer. A local attacker could potentially exploit this by sending...