Linux Distros Unpatched Vulnerability : CVE-2026-90317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Invalidate RCU pointers after final spin unlock In a sleepable BPF program, a spin lock can provide the only RCU protection for a kptr. The final...

CVE-2026-90373 wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear mt7915removeinterface cleared the wcid mask bit with no lock held and before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared with the...

CVE-2026-90373

A race condition in the Linux kernel mt76 mt7915 WiFi driver allowed mt7915_remove_interface() to clear the wcid mask bit without holding the mutex and before clearing the RCU wcid pointer. On DBDC (dual-band dual-concurrent) configurations, the two wiphys share one mt76_dev, so this raced with a...

Linux Distros Unpatched Vulnerability : CVE-2026-89708

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per- session teardown path can free a session while rpciod...

DEBIAN-CVE-2026-89708

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...

CVE-2026-89708 nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...

CVE-2026-89709

CVE-2026-89709 affects the Linux kernel's lockd and nfsd subsystems. The nlmsvc_ops pointer is published and cleared with plain stores while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. After rmmod nfsd, a stale load produces either a NULL pointer dereference or a mo...

CVE-2026-89709

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvcops dispatch nlmsvcops is published by nfsdlockdinit and cleared by nfsdlockdshutdown with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer...

SUSE CVE-2026-74325

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: use kfreercu for offchannel link in mt76putvifphylink mt76putvifphylink frees the offchannel mlink with plain kfree after rcuassignpointerNULL. However, rcuassignpointer only prevents future RCU readers from obtaining...

PT-2026-69792

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth management component where RCU-protected pointers are dereferenced outside of critical sections. This behavior is invalid and can lead to a Use-After-Fre...

Linux Distros Unpatched Vulnerability : CVE-2026-43050

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - atm: lec: fix use-after-free in sockdefreadable A race condition exists between lecatmclose setting priv-lecd to NULL and concurrent access to priv-lecd in...

CVE-2026-43050 atm: lec: fix use-after-free in sock_def_readable()

In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix use-after-free in sockdefreadable A race condition exists between lecatmclose setting priv-lecd to NULL and concurrent access to priv-lecd in sendtolecd, lechandlebridge, and lecatmsend. When the socket is freed via...

PT-2026-36467

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Linux kernel between the lec atm close function setting priv-lecd to NULL and concurrent access to priv-lecd within the send to lecd, lec handle bridge, an...

CLSA-2025-1754037789 Fix of 5 CVEs

Focal update: v5.4.291 upstream stable release LP: 2106002 // CVE-2025-21760 // CVE-url: https://ubuntu.com/security/CVE-2025-21760 - ndisc: extend RCU protection in ndiscsendskb Focal update: v5.4.291 upstream stable release LP: 2106002 // CVE-2025-21761 // CVE-url:...

kernel: mt76: fix use-after-free by removing a non-RCU wcid pointer

A vulnerability was found in the Linux kernel's mt76 wi-fi driver. A concurrency bug causes the mtxq TX queue to maintain a raw pointer to a wcid structure mtxq-wcid that might be freed by the time it is accessed. This issue can lead to a use-after-free scenario, leading to system instability,...

CVE-2022-49328

CVE-2022-49328 is a vulnerability in the Linux kernel mt76 driver where a use-after-free can occur in mt76_txq_schedule due to an unprotected wcid pointer (non-RCU). The issue is addressed by guarding the mtxq->wcid with an rcu_lock between mt76_txq_schedule and sta_info_alloc/free, per the re...

CVE-2024-50127 net: sched: fix use-after-free in taprio_change()

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix use-after-free in tapriochange In 'tapriochange', 'admin' pointer may become dangling due to sched switch / removal caused by 'advancesched', and critical section protected by 'q-currententrylock' is too small to...

kernel: tls: fix missing memory barrier in tls_init

In the Linux kernel, the following vulnerability has been resolved: tls: fix missing memory barrier in tlsinit In tlsinit, a write memory barrier is missing, and store-store reordering may cause NULL dereference in tlssetsockopt,getsockopt. CPU0 CPU1 ----- ----- // In tlsinit // In tlsctxcreate c...

kernel: inet: fully convert sk->sk_rx_dst to RCU rules

A use-after-free vulnerability was found in the TCP IP protocol in the Linux Kernel, where a delete operation of the RCU-protected pointer is supposed to clear the pointer before the callrcu/synchronizercu guarding the actual memory freeing. This flaw allows a local attacker to crash the system o...