Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ftrace: Fixed a use-after-free issue related to dynamic ftraceops. KASAN reported a use-after-free when using ftrace. It was discovered that perf registered two ftrace operations with the same content, both being dynamic. Afte...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: fixed the “scheduling while atomic” issue in mptcppmnl.AppendNewLocalAddr. If multiple connection requests attempt to create an implicit mptcp endpoint simultaneously, more than one caller may end up using...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ftrace: Fixed a possible use-after-free issue in ftracelocation. KASAN reports a bug: BUG: KASAN: use-after-free in ftracelocation+0x90/0x120 Reading an 8-byte value at address ffff888141d40010 by task insmod/424 CPU: 8 PID: 4...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100698)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100698 advisory. In the Linux kernel, the following vulnerability has been resolved: vrf: Fix a potential NPD when removing a port from a VRF RCU readers that identified a net device...

CVE-2026-74512 audit: fix potential use-after-free in audit_del_rule()

In the Linux kernel, the following vulnerability has been resolved: audit: fix potential use-after-free in auditdelrule auditdelrule destroys e-rule.exe via auditremovemarkrule before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in auditfilte...

CVE-2026-72094

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-fence: Fix potential NULL pointer dereference The commit mentioned in the fixes tag below introduced a mechanism through which fence producers can fully decouple from fence consumers. This, desirable, mechanism is...

UBUNTU-CVE-2026-72094

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-fence: Fix potential NULL pointer dereference The commit mentioned in the fixes tag below introduced a mechanism through which fence producers can fully decouple from fence consumers. This, desirable, mechanism is...

CVE-2026-72012

In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Call synchronizercu when unregistering This ensures that any RCU readers traversing the instance list have finished, before releasing the reference on the tracer that the instance points to...

CVE-2026-74255 tipc: fix UAF in tipc_l2_send_msg()

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in tipcl2sendmsg Syzbot reported a slab-use-after-free in ipvlanhardheader when called from tipcl2sendmsg. The root cause is that tipcdisablel2media calls synchronizenet while b-mediaptr is still valid. This allows...

CVE-2026-72404

CVE-2026-72404 concerns the Linux kernel TIPC UDP bearer teardown where a use-after-free can occur due to premature dst_cache_destroy() during cleanup_bearer(). The issue arises when dst_cache_destroy() frees per-CPU cache memory and cached entries before all readers finish, risking use-after-fre...

CVE-2026-72404 tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in cleanupbearer due to premature dstcachedestroy TIPC UDP media bearer teardown calls dstcachedestroy on its replicast caches before calling synchronizenet to wait for concurrent RCU readers transmitters to finish:...

CVE-2026-72094

The CVE-2026-72094 entry describes a Linux kernel vulnerability in dma-buf: dma-fence where a race between the signaled-bit and the dma_fence_ops pointer could allow a NULL dereference on weakly ordered platforms. The fix decouples fence producers and consumers by using the signaled-bit as the de...

PT-2026-72964

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the audit system. The audit del rule function destroys e-rule.exe through audit remove mark rule before the rule is unlinked from RCU-visible filter list...

CVE-2026-68332

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix potential use-after-free in airohappedeinit airohappedeinit replaces the NPU pointer with NULL via rcureplacepointer but does not wait for existing RCU readers to exit before calling ppedeinit and airohanpuput...

EUVD-2026-55590

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner autodisconnect nl80211netlinknotify walks the cfg80211 wireless device list when a NETLINKGENERIC socket is released. If the socket owns a connection, the notifier queues the embedd...

CVE-2026-64525

A flaw was found in the Linux kernel's xfrm IPSec framework component. An issue with improper RCU Read-Copy-Update synchronization in the xfrmpolicyfini function, specifically the serial execution of synchronizercu for each network namespace during cleanup, can lead to a Denial of Service DoS...

CVE-2026-64525

In the Linux kernel, the following vulnerability has been resolved: xfrm: move policybydst RCU sync from per-netns .exit to .preexit The struct pernetoperations docstring in include/net/netnamespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking...

CVE-2026-64525

The CVE describes a Linux kernel xfrm policy_bydst RCU synchronization issue where xfrm_policy_fini() called synchronize_rcu() during namespace exit, causing long RCUs and heavy cleanup workload when many namespaces are torn down. The fix moves the policy flush and related workqueue drains into a...

CVE-2026-64525 xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit

In the Linux kernel, the following vulnerability has been resolved: xfrm: move policybydst RCU sync from per-netns .exit to .preexit The struct pernetoperations docstring in include/net/netnamespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking...

SUSE CVE-2026-64045

In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - use cached peer pointer in ovpntcpclose ovpntcpclose loads the ovpnsocket via rcudereferenceskuserdata under rcureadlock, takes a reference on sock-peer, caches the peer pointer in a local, and drops the read lock. It...