SUSE CVE-2026-64421

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix use-after-free on remove KASAN reports a slab-use-after-free in mediaentityremovelink during rmmod of imx8isi: BUG: KASAN: slab-use-after-free in mediaentityremovelink+0x608/0x650 Read of size 2 at addr...

SUSE CVE-2026-64452

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

CVE-2026-64421

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix use-after-free on remove KASAN reports a slab-use-after-free in mediaentityremovelink during rmmod of imx8isi: BUG: KASAN: slab-use-after-free in mediaentityremovelink+0x608/0x650 Read of size 2 at addr...

UBUNTU-CVE-2026-64473

In the Linux kernel, the following vulnerability has been resolved: vfio: Remove device debugfs before releasing devres VFIO device debugfs files created with debugfscreatedevmseqfile store a devres allocated debugfsdevmentry as inode private data. vfiounregistergroupdev currently calls...

CVE-2026-64433

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF of hciconnparams in adddevicecomplete adddevicecomplete runs from the hcicmdsyncwork kworker, which holds only hcireqsynclock and not hcidevlock. It calls hciconnparamslookup and then dereferences the...

CVE-2026-64396

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct filelock in SMB2LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred in the FILELOCKDEFERRED path, ksmbd registers the asynchronous work into the connection's asyncrequests...

UBUNTU-CVE-2026-64452

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

CVE-2026-64509 rust: block: fix GenDisk cleanup paths

In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build still has fallible work after blkmqallocdisk, but its error path only recovers the foreign queue data. That leaks the temporary gendisk and requestqueue until later...

CVE-2026-64500

In the Linux kernel, the following vulnerability has been resolved: iio: adc: lpc32xx: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "lpc32xxadcprobe in drivers/iio/adc/lpc32xxadc.c registers its interrupt handler with devmrequestirq before it initializes...

CVE-2026-64453

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbiodisconnect walks usbio-clilist in reverse and uninitializes each auxiliary device. auxiliarydeviceuninit drops the device reference, and for an unbound child that can r...

CVE-2026-64452

CVE-2026-64452 (Linux kernel 6LoWPAN) involves a race condition in 6LoWPAN’s Next Header Compression (NHC) handling that can cause a use-after-free in lowpan_nhc_do_uncompression when an NHC descriptor is freed while another path accesses nhc->name in an error path. The issue arises from holdi...

CVE-2026-64452 6lowpan: fix NHC entry use-after-free on error path

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

CVE-2026-64421 media: nxp: imx8-isi: Fix use-after-free on remove

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix use-after-free on remove KASAN reports a slab-use-after-free in mediaentityremovelink during rmmod of imx8isi: BUG: KASAN: slab-use-after-free in mediaentityremovelink+0x608/0x650 Read of size 2 at addr...

CVE-2026-64421 media: nxp: imx8-isi: Fix use-after-free on remove

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix use-after-free on remove KASAN reports a slab-use-after-free in mediaentityremovelink during rmmod of imx8isi: BUG: KASAN: slab-use-after-free in mediaentityremovelink+0x608/0x650 Read of size 2 at addr...

CVE-2026-64421

CVE-2026-64421 is a use-after-free in the Linux kernel's imx8_isi driver (NXP i.MX8 Image Sensor Interface). During module removal (rmmod), mxc_isi_remove() called mxc_isi_crossbar_cleanup() before mxc_isi_v4l2_cleanup(), freeing media entity pads while the subsequent V4L2 cleanup still attempted...

CVE-2026-64418 mm: shrinker: fix shrinker_info teardown race with expansion

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix shrinkerinfo teardown race with expansion expandshrinkerinfo iterates all visible memcgs under shrinkermutex, including memcgs that have not finished -cssonline yet. Once pn-shrinkerinfo has been published,...

EUVD-2026-48940

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct filelock in SMB2LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred in the FILELOCKDEFERRED path, ksmbd registers the asynchronous work into the connection's asyncrequests...

CVE-2026-64381

CVE-2026-64381 is a memory leak in the Linux kernel SMB client (CIFS), specifically in receive_encrypted_standard(). The function allocates next_buffer before checking whether the number of compound PDUs has reached MAX_COMPOUND. When that check fails, the function returns immediately without ass...

EUVD-2026-48876

In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is never freed on early ULPI device registration failures. Fix this by initialising the device structure earlier and releasing the initial reference...

CVE-2026-64329

A use-after-free race condition exists in the Linux kernel's USB Type-C UCSI CCG driver. In the device remove path (ucsi_ccg_remove()), ucsi_destroy() frees the ucsi object before free_irq() is called, so an in-flight threaded IRQ handler may dereference the freed memory. The fix reorders free_ir...