PT-2026-72658

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log-one page buf when adopting on-disk page size log replay allocates log-one page buf using the page size that was chosen from the host PAGE SIZE: log-one page buf = kmalloclog-page size, GFP NOFS; Later, when a...

PT-2026-72309

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu list annotations and operations sashiko-bot remarked the missing use of list add rcu in bcm rx|tx setup to have a proper initialized bcm op structure when bcm proc show traverses the bcm op's under rcu...

PT-2026-73025

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE arm vsmmu vsid to sid maps a guest's vSID to a single physical Stream ID taken from master-streams0, assuming a device has exactly one stream. A device with...

Linux Distros Unpatched Vulnerability : CVE-2026-74314

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpfobjfreefields when a value is being replaced or recycled. That mak...

Linux Distros Unpatched Vulnerability : CVE-2026-72111

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reset register bounds before narrowing retval range in checkmemaccess When the BPF verifier processes a context load of an LSM hook return value, it calls...

PT-2026-72943

In the Linux kernel, the following vulnerability has been resolved: of/address: Fix NULL bus dereference in of pci range parser one The bus matching rework made of match bus return NULL for nodes with ranges/dma-ranges but no local address-cells. parser init stored that NULL bus, and the range...

PT-2026-72305

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device removal RX: an RX SETUP update! for an existing op skipped can rx register unconditionally, even when a concurrent NETDEV UNREGISTER had already torn down its registration op-rx reg dev ...

PT-2026-72566

In the Linux kernel, the following vulnerability has been resolved: afs: Fix error code in afs extract vl addrs The error codes on these paths are only set on the first iteration through the loop. Set the correct error code on every iteration...

PT-2026-72892

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xe exec ioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs,...

PT-2026-72661

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xprtrdma module where a single reference count rl kref was used to manage two distinct lifetimes: the wake-up of an RPC task upon reply and the return of an rpcrdm...

PT-2026-72788

In the Linux kernel, the following vulnerability has been resolved: of: reserved mem: avoid post-init UAF when alloc reserved mem array fails The global pointer 'reserved mem' continues to reference the reserved mem array which lives in initdata if alloc reserved mem array fails. of reserved mem...

PT-2026-72677

In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvec rx completed In nvec rx completed, when an incomplete RX transfer is detected, nvec msg free is called to return the message back to the pool by clearing its 'used' atomic flag. Immediate...

Linux Distros Unpatched Vulnerability : CVE-2026-72123

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: bcm: defer rxop deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 can: bcm: use callrcu instead of costly synchronizercu replaced...

PT-2026-72584

In the Linux kernel, the following vulnerability has been resolved: hwmon: adm1275: Prevent reading uninitialized stack While adding support for the ROHM BD127X0 hot-swap controllers, sashiko reported an error in device-name comparison, which can lead to reading uninitialized stack memory. Quotin...

PT-2026-73014

In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh-lock for f6i list walks in replace check and notify fib6 check nh list and nexthop replace notify walk nh-f6i list during an RTNL-serialized nexthop replace without holding nh-lock. IPv6 RTM NEWROUTE/RTM DELROUTE...

PT-2026-72300

In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register bounds before narrowing retval range in check mem access When the BPF verifier processes a context load of an LSM hook return value, it calls mark reg s32 range to narrow the register to the hook's valid range...

Linux Distros Unpatched Vulnerability : CVE-2026-74520

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/iommufd: Fix IOPF group ownership UAF iopfgroupalloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault...

Linux Distros Unpatched Vulnerability : CVE-2026-72073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mmc: vub300: fix use-after-free on probe failure The vub300 driver lifetime-manages its controller state using vub300-kref, with vub300delete freeing the mmc ho...

Linux Distros Unpatched Vulnerability : CVE-2026-72383

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: fix addrwqtimer race in sctpfreeaddrwq sctpfreeaddrwq previously removed addrwqtimer using timerdelete while holding addrwqlock. However, timerdelete does...

PT-2026-72301

In the Linux kernel, the following vulnerability has been resolved: io uring/bpf-ops: reject re-registration of an already-bound ops io install bpf only rejects a second registration on the ctx side ctx-bpf ops and sets the per-map back-pointer ops-priv unconditionally. The struct ops link path...