EUVD-2026-58878

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu list annotations and operations sashiko-bot remarked the missing use of listaddrcu in bcmrx|txsetup to have a proper initialized bcmop structure when bcmprocshow traverses the bcmop's under rcureadlock. ...

EUVD-2026-59052

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-fence: Fix potential NULL pointer dereference The commit mentioned in the fixes tag below introduced a mechanism through which fence producers can fully decouple from fence consumers. This, desirable, mechanism is...

CVE-2026-72072 net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadatadst on RX SC delete When an offloaded MACsec RX SC is deleted, macsecdelrxscctx freed the per-SC metadatadst with metadatadstfree, which kfrees the object unconditionally and ignor...

CVE-2026-72071 tracing/user_events: Fix use-after-free in user_event_mm_dup()

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Fix use-after-free in usereventmmdup usereventmmdup walks the parent mm's enabler list locklessly under rcureadlock during fork from copyprocess; it does not take eventmutex: rcureadlock;...

EUVD-2026-59029

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Fix use-after-free in usereventmmdup usereventmmdup walks the parent mm's enabler list locklessly under rcureadlock during fork from copyprocess; it does not take eventmutex: rcureadlock;...

EUVD-2026-59030

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadatadst on RX SC delete When an offloaded MACsec RX SC is deleted, macsecdelrxscctx freed the per-SC metadatadst with metadatadstfree, which kfrees the object unconditionally and ignor...

EUVD-2026-59027

In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rtspinunlock rtspinunlock releases the RCU protection before unlocking the lock. That opens the door for the following UAF scenario: T1 T2 spinlock&p-lock; rcureadlock; invalidatep;...

CVE-2026-72069 locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()

In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rtspinunlock rtspinunlock releases the RCU protection before unlocking the lock. That opens the door for the following UAF scenario: T1 T2 spinlock&p-lock; rcureadlock; invalidatep;...

CVE-2026-72034 fhandle: reject detached mounts in capable_wrt_mount()

In the Linux kernel, the following vulnerability has been resolved: fhandle: reject detached mounts in capablewrtmount The recent fhandle RCU fix moved the mount namespace capability check into capablewrtmount, so a non-NULL mntnamespace survives the nscapable dereference. The helper still assume...

EUVD-2026-58982

In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local-interfaces under RCU. The bulk hardware teardown path removes entries with listdel, so an asynchronous transmit completion can...

CVE-2026-72024 mac802154: remove interfaces with RCU list deletion

In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local-interfaces under RCU. The bulk hardware teardown path removes entries with listdel, so an asynchronous transmit completion can...

EUVD-2026-59111

In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Call synchronizercu when unregistering This ensures that any RCU readers traversing the instance list have finished, before releasing the reference on the tracer that the instance points to...

CVE-2026-72012 tracing/osnoise: Call synchronize_rcu() when unregistering

In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Call synchronizercu when unregistering This ensures that any RCU readers traversing the instance list have finished, before releasing the reference on the tracer that the instance points to...

PT-2026-72213

In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local-interfaces under RCU. The bulk hardware teardown path removes entries with list del, so an asynchronous transmit completion can...

PT-2026-72511

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmp gq start timer A race condition exists between device teardown inetdev destroy and incoming IGMP query processing igmp rcv, leading to a Use-After-Free in the IGMP timer callback. During devi...

PT-2026-72510

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary...

PT-2026-72623

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix order of kfree rcu and rcu assign pointer Sashiko pointed out that kfree rcu was called before rcu assign pointer in handling the comment extension. Fix the order so that rcu assign pointer called first...

PT-2026-72799

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 "bpf: Avoid RCU context warning when unpinning htab with internal structs" moved inode cleanup from -free inode into -destroy inode to avoid sleepin...

PT-2026-72560

In the Linux kernel, the following vulnerability has been resolved: afs: Fix lack of locking around modifications of net-cells dyn ino Fix the lack of locking around modifications of net-cells dyn ino by taking net-cells lock exclusively. This also requires to cell to be removed from net-cells dy...

PT-2026-72774

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject sleepable BPF LSM CGROUP programs at load time The cgroup shim runs under rcu read lock dont migrate, so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts...