CVE-2026-74310

In the Linux kernel, the following vulnerability has been resolved: vhost/net: complete zerocopy ubufs only once vhost-net initializes one ubufinfo per outstanding zerocopy TX descriptor and hands it to the backend socket. The networking stack may then clone a zerocopy skb before all skb referenc...

UBUNTU-CVE-2026-72407

In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in genevegrocomplete Even with both paths gated on gs-grohint, genevegrocomplete re-derives the inner dispatch type and length from the packet and the current gs-grohint, independently of...

UBUNTU-CVE-2026-74406

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...

EUVD-2026-59507

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps for bpfmapelem iterators Exclusive maps aka exclproghash are meant to be reachable only from the single program whose hash matches. This is enforced by checkmapprogcompatibility when the map is referenc...

CVE-2026-74331 firmware_loader: Fix recursive lock in device_cache_fw_images()

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: Fix recursive lock in devicecachefwimages A recursive locking deadlock can occur in the firmware loader's power management notification handler. During system suspend or hibernation preparation, fwpmnotify calls...

CVE-2026-72154

CVE-2026-72154 describes a Linux kernel vulnerability in the OpenRISC path related to jump_label SMP cache syncing. The issue arose from an OpenRISC-specific implementation that copied from arm64 and didn’t correctly handle icache invalidation on remote cores, which could leave stale static_key c...

PT-2026-72870

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rxrpc recvmsg oob function where out-of-band OOB messages are handled incorrectly when using the MSG PEEK flag. While the unlink operation from recvmsg oobq is...

PT-2026-72935

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the binfmt misc module when a mount fails. The bm get tree function takes a reference to the user namespace and passes it to get tree keyed as the sget key, which...

Linux Distros Unpatched Vulnerability : CVE-2026-72157

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: thunderbolt: Fix frags overflow by bounding framecount tbnetpoll assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the...

Exploit for Write-what-where Condition in Linux Linux_Kernel

No d...

Exploit for Use After Free in Linux Linux_Kernel

GhostLock SELinux park — SM-S948U1 / AZF1 m3q Research snap...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-23111 — noddlenpottato nftables catchall UAF → unpr...

Exploit for Use After Free in Linux Linux_Kernel

vivo/iQOO Temporary Root Toolkit No unlocking required, no...

CVE-2026-68287

The CVE-2026-68287 issue affects the Linux kernel’s drop_monitor feature. On 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, 64-bit attributes (PC and TIMESTAMP) appended via nla_put_u64_64bit() may cause a 64-bit alignment pad, and net_dm_packet_report_size()/net_dm_hw_packe...

CVE-2026-68223 media: meson: vdec: Fix memory leak in error path of vdec_open

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: Fix memory leak in error path of vdecopen The vdecopen function previously jumped directly to errm2mrelease when vdecinitctrls failed, skipping release of the m2m context. This caused a resource leak. Fix it b...

CVE-2026-68215 media: radio-si476x: Unregister v4l2_device on probe failure

In the Linux kernel, the following vulnerability has been resolved: media: radio-si476x: Unregister v4l2device on probe failure si476xradioprobe registers radio-v4l2dev before allocating the V4L2 controls and before registering the video device. If any of those later steps fails, probe returns...

The vulnerability of the arm_cmn_discover() function in the drivers/perf/arm-cmn.c module of the Linux kernel’s performance monitoring driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the armcmndiscover function in the drivers/perf/arm-cmn.c file of the Linux kernel’s performance monitoring driver relates to the copying of buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this vulnerability could allow an...

The vulnerability of the mptcp_subflow_init() function in the kernel’s net/mptcp/protocol.c file in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the mptcpsubflowinit function in the net/mptcp/protocol.c module of the Linux kernel relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

CVE-2026-64371 proc: protect ptrace_may_access() with exec_update_lock (part 1)

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess: -...

SUSE CVE-2026-64092

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: fix tpvars reference leak in receiver shutdown The receiver shutdown timer handler, batadvtpreceivershutdown, is responsible for releasing the tpvars reference it holds. However, the existing logic for...