Linux Distros Unpatched Vulnerability : CVE-2026-74576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b mm/slab: avoid allocating slabobjext array from its own slab avoided...

PT-2026-72806

In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix TOCTOU race in luo session retrieve Extend the scope of the rwsem read lock in luo session retrieve to overlap with the acquisition of the session mutex. This prevents a concurrent thread from releasing and freein...

PT-2026-72987

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid deadlocks in iso sock timeout iso sock timeout takes lock sock, so sync disabling the timer while holding that lock may deadlock. iso sock timeout may also run concurrently with iso conn del, which leads to...

PT-2026-73006

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bounds clear bit in ath12k mac dp peer cleanup ath12k mac dp peer cleanup clears the ML peer ID slot on the free ml peer id map bitmap by indexing it with dp peer-peer id. That is wrong: dp peer-peer id f...

Linux Distros Unpatched Vulnerability : CVE-2026-74563

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rds: tcp: hold the RCU lock across ipv6chkaddr in rdstcpladdrcheck rdstcpladdrcheck looks up a scoped IPv6 interface with devgetbyindexrcu, drops the RCU...

PT-2026-72836

In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpf set|remove dentry xattr for negative dentries bpf set dentry xattr and bpf remove dentry xattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry...

PT-2026-72989

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in iso conn ready sk deref in iso conn ready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk is currently accessed without either: Task 1 Task 2 iso...

PT-2026-73025

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE arm vsmmu vsid to sid maps a guest's vSID to a single physical Stream ID taken from master-streams0, assuming a device has exactly one stream. A device with...

PT-2026-72849

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix wrong pci get drvdata type in AER handlers rtw89 stores an ieee80211 hw pointer via pci set drvdata at probe time, but io error detected and io resume retrieve it as a net device pointer. This causes netif device...

PT-2026-72970

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix list corruption in allocate file region entries allocate file region entries tops up resv-region cache with freshly allocated file region descriptors. The allocation uses GFP KERNEL, so resv-lock is dropped around...

PT-2026-72818

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls bpf: prevent unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in cls bpf offload cmd. Reproducer on netdevsim: add a skip sw cls bpf filter, set the bpf tc accept debugfs knob to 0, then...

PT-2026-72908

In the Linux kernel, the following vulnerability has been resolved: can: peak usb: peak usb start: fix double free of transfer buffer on URB submit error In peak usb start, each RX URB transfer buffer is allocated with kmalloc and the URB is flagged URB FREE BUFFER so that the final usb free urb...

PT-2026-72958

In the Linux kernel, the following vulnerability has been resolved: afs: Fix UAF when sending a message In afs make call, there's a race with async call reception and destruction. If a call is dispatched that doesn't have call-write iter set used to specify the data content for FS.StoreData, then...

PT-2026-72962

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMT OP PAIR DEVICE command by walking hdev-mgmt pending. The lookup returned a command that wa...

PT-2026-72972

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopf group alloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufd fault iopf handler also queued an accepted group in...

Linux Distros Unpatched Vulnerability : CVE-2026-74510

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMTOPPAIRDEVICE command b...

PT-2026-72217

In the Linux kernel, the following vulnerability has been resolved: riscv: probes: save original sp in rethook trampoline Reading a word from the stack in a kretprobe crashes a risc-v kernel. $ cd /sys/kernel/tracing/ $ echo 'r n tty write $stack0' dynamic events $ echo 1 events/kprobes/enable...

PT-2026-72799

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 "bpf: Avoid RCU context warning when unpinning htab with internal structs" moved inode cleanup from -free inode into -destroy inode to avoid sleepin...

PT-2026-72853

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix integer overflow in radeon align pitch radeon align pitch has the same kind of overflow issue as the old amdgpu helper: both the alignment round-up add and the final 'aligned cpp' calculation can overflow signed...

PT-2026-72504

In the Linux kernel, the following vulnerability has been resolved: dm era: fix NULL pointer dereference in metadata open metadata open returns NULL when kzalloc obj fails, but the caller era ctr only checks IS ERRmd. Since IS ERRNULL returns false, the NULL pointer is treated as a valid result a...