Linux Distros Unpatched Vulnerability : CVE-2026-74514

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages The accountmem and unaccountmem functions call getuid which increments the reference count of...

PT-2026-72406

In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm file refcount leak on cached nlm do fopen failure The cached-file path in nlm lookup file reaches the found: label unconditionally, even when nlm do fopen fails. At that label result and file-f count are updated...

Linux Distros Unpatched Vulnerability : CVE-2026-74472

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ublk: reset kernel-owned devinfo fields in ublkctrladddev ublkctrladddev memcpys the userspace ublksrvctrldevinfo into ub-devinfo and then fixes up the fields t...

PT-2026-72943

In the Linux kernel, the following vulnerability has been resolved: of/address: Fix NULL bus dereference in of pci range parser one The bus matching rework made of match bus return NULL for nodes with ranges/dma-ranges but no local address-cells. parser init stored that NULL bus, and the range...

PT-2026-72543

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix barriering when walking subrequest list Fix the barriering used when walking the subrequest list in retry as there's a possibility of seeing a subreq that's just been added by the application thread...

PT-2026-72499

In the Linux kernel, the following vulnerability has been resolved: drm/xe: free madvise VMA array on L2 flush failure xe vm madvise ioctl allocates madvise range.vmas in get vmas. After get vmas succeeds with at least one VMA, error paths must go through free vmas so the array is released before...

PT-2026-72173

In the Linux kernel, the following vulnerability has been resolved: device property: initialize the remaining fields of fwnode handle in fwnode init If a firmware node is allocated on the stack for instance: temporary software node whose life-time we control or on the heap - but using a non-zeroi...

PT-2026-72655

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwr wp create during connect frwr wp create creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave...

PT-2026-72558

In the Linux kernel, the following vulnerability has been resolved: iomap: release pages on atomic dio size mismatch If bio iov iter get pages or the bounce helper succeeds but builds a short bio, the REQ ATOMIC size check rejects it before submission. The old error path only dropped the bio...

PT-2026-73012

In the Linux kernel, the following vulnerability has been resolved: xsk: fix buffer leak in xsk drop skb for AF XDP multi-buffer Tx This patch is inspired by the check1 from sashiko. It says when overflow happens, the address of cq to be published is invalid. Actually the severer thing is the who...

PT-2026-72545

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Use proper mm struct in in uprobe trampoline In the unregister path we use in uprobe trampoline check with current-mm for the VMA lookup, which is wrong, because we are in the tracer context, not the traced process...

PT-2026-72512

In the Linux kernel, the following vulnerability has been resolved: gpio: mvebu: free generic chips on unbind irq alloc domain generic chips allocates generic chip data that must be freed via irq domain remove generic chips. The devres action mvebu gpio remove irq domain only called irq domain...

PT-2026-72737

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix URB leak in alloc mtk intr urb error path When btmtk isopkt pad fails, the previously allocated URB is not freed, leaking the urb structure. Add usb free urb before returning the error...

PT-2026-72412

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Free arenas on btt init error paths The arenas allocated by discover arenas or create arenas are not freed on some error paths in btt init. This leaks memory when BTT initialization fails. Call free arenas from the...

PT-2026-72547

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bo meminfo When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle...

PT-2026-72497

In the Linux kernel, the following vulnerability has been resolved: tracing/remotes: Fix leak in trace remote alloc buffer error path If page allocation fails in trace remote alloc buffer, desc-nr cpus is not yet incremented for the current CPU. As a consequence, on error, half-allocated rb desc...

PT-2026-72401

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch In alloc hugetlb folio, a single h cg pointer is used for both the rsvd and non-rsvd hugetlb cgroup charges. When map chg is set, hugetlb cgroup charge cgroup rsvd stor...

PT-2026-72248

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure t7xx cldma late init creates md ctrl-gpd dmapool before initializing the TX and RX rings. If any ring initialization fails, the error path frees the already initialized...

PT-2026-72454

In the Linux kernel, the following vulnerability has been resolved: fbdev: vesafb: fix memory leak in vesafb probe Since commit 73ce73c30ba9 "fbdev: Transfer video= option strings to caller; clarify ownership" the string returned from fb get options is expected to be freed by the caller. But the...

PT-2026-72668

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling ams event to channel may return a pointer past the end of dev-channels when no matching scan index is found. This can lead to invalid memory access in ams...