CVE-2026-74718 devlink: fix net namespace reference leak in reload

In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlinknlreloaddoit calls devlinknetnsget, which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not...

CVE-2026-74715

CVE-2026-74715 is a race condition in the Linux kernel BPF conntrack kfuncs (__bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry()). The opts argument can reference a shared BPF map value, and opts->netns_id is read independently during namespace reference acquisition and release. A concurrent wr...

EUVD-2026-64402

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...

CVE-2026-74670 ipvs: stop estimator after disabled calc phase

In the Linux kernel, the following vulnerability has been resolved: ipvs: stop estimator after disabled calc phase IPVS estimator kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If network namespace teardown clears ipvs-enable during that phase,...

CVE-2026-74670

CVE-2026-74670 affects the Linux kernel IPVS (IP Virtual Server) estimator subsystem. The IPVS estimator kthread starts with zeroed chain and tick limits until its initial calculation phase completes. If a network namespace teardown clears ipvs->enable during that phase, ip_vs_est_calc_phase()...

CVE-2026-74670 ipvs: stop estimator after disabled calc phase

In the Linux kernel, the following vulnerability has been resolved: ipvs: stop estimator after disabled calc phase IPVS estimator kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If network namespace teardown clears ipvs-enable during that phase,...

EUVD-2026-64357

In the Linux kernel, the following vulnerability has been resolved: ipvs: stop estimator after disabled calc phase IPVS estimator kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If network namespace teardown clears ipvs-enable during that phase,...

CVE-2026-74619 ovl: don't warn when the mount is completed from another user namespace

In the Linux kernel, the following vulnerability has been resolved: ovl: don't warn when the mount is completed from another user namespace fsopen records the caller's user namespace in fc-userns and hands back an ordinary file descriptor. Nothing ties the task that calls fsconfigFSCONFIGCMDCREAT...

EUVD-2026-64556

In the Linux kernel, the following vulnerability has been resolved: ovl: don't warn when the mount is completed from another user namespace fsopen records the caller's user namespace in fc-userns and hands back an ordinary file descriptor. Nothing ties the task that calls fsconfigFSCONFIGCMDCREAT...

CVE-2026-74619 ovl: don't warn when the mount is completed from another user namespace

In the Linux kernel, the following vulnerability has been resolved: ovl: don't warn when the mount is completed from another user namespace fsopen records the caller's user namespace in fc-userns and hands back an ordinary file descriptor. Nothing ties the task that calls fsconfigFSCONFIGCMDCREAT...

CVE-2026-74619

This Linux kernel vulnerability affects the overlayfs component. An unprivileged task can trigger a WARN_ON() in ovl_fill_super() by creating a user and mount namespace in a child process, calling fsopen("overlay"), passing the fscontext file descriptor to the parent, and having the parent issue ...

CVE-2026-74618 binfmt_misc: don't warn when the mount is completed from another user namespace

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't warn when the mount is completed from another user namespace fsopen records the caller's user namespace in fc-userns and hands back an ordinary file descriptor. Nothing ties the task that calls...

CVE-2026-74618 binfmt_misc: don't warn when the mount is completed from another user namespace

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't warn when the mount is completed from another user namespace fsopen records the caller's user namespace in fc-userns and hands back an ordinary file descriptor. Nothing ties the task that calls...

EUVD-2026-64555

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't warn when the mount is completed from another user namespace fsopen records the caller's user namespace in fc-userns and hands back an ordinary file descriptor. Nothing ties the task that calls...

CVE-2026-74618

CVE-2026-74618 affects the Linux kernel 's binfmt_misc filesystem. The root cause is a WARN_ON() in bm_fill_super() that triggers when a binfmt_misc mount is completed from a different user namespace than the one that created the fscontext via fsopen(). Because fsconfig(FSCONFIG_CMD_CREATE) autho...

CVE-2026-74615 vxlan: do not arm the ageing timer on a device that is down

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlanchangelink arms vxlan-agetimer whenever the requested ageing interval differs from the configured one: if conf.ageinterval != vxlan-cfg.ageinterval...

CVE-2026-74615

CVE-2026-74615 is a slab-use-after-free in the Linux kernel vxlan module. The root cause is that vxlan_changelink() arms the FDB ageing timer without a netif_running() check, so on a never-brought-up device the timer persists after free_netdev() releases the vxlan_dev struct, causing the timer co...

SUSE CVE-2026-75140

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited...

Linux Distros Unpatched Vulnerability : CVE-2026-74715

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and...

PT-2026-84279

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.15 @xmldom/xmldom versions prior to 0.9.12 xmldom versions 0.1.5 through 0.6.0 Description The appendElement function in lib/sax.js uses copy to clone the complete currentNSMap for every nested element that...