kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle

A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free UAF vulnerability,...

CVE-2026-74578

In the Linux kernel, the following vulnerability has been resolved: crypto: algifskcipher - force synchronous processing on trees without ctx-state The AIO/async path in skcipherrecvmsg passes the socket-wide ctx-iv directly into the skcipher request. After iosubmit the socket lock is dropped and...

CVE-2026-74578

CVE-2026-74578 affects the Linux kernel crypto/algif_skcipher path. The AIO/async path in skcipher_recvmsg() could expose an attacker-controlled IV by overwriting ctx->iv via concurrent ALG_SET_IV writes, enabling IV/keystream reuse for CTR/stream modes and potentially plaintext recovery of co...

CVE-2026-74575

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tbxdphandlerequest runs on systemwq and queues xd-statework via queuedelayedwork in three request handlers: PROPERTIESCHANGEDREQUEST, UUIDREQUEST via...

CVE-2026-74568

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Fix race between LPI release and re-registration Fix a potential race between decrementing an LPI's reference count and evicting that structure from the LPI xarray. LPI structures are maintained in the VGIC LPI...

CVE-2026-74555

In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix HA resume deadlock and hisisas disk-wake race Commit fbefe22811c3 "scsi: libsas: Don't always drain event workqueue for HA resume" introduced sasresumehanosync to avoid a deadlock: the PHYERESUMETIMEOUT handler,...

CVE-2026-74552

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Only report alarms if driver is ready Userspace can read sysfs attributes before driver registration is complete, immediately after devmhwmondeviceregisterwithinfo has been called. At that time, data-hwmondev is not y...

CVE-2026-74546

In the Linux kernel, the following vulnerability has been resolved: hwmon: adt7470 Fix divide-by-zero TOCTOU crash in fan speed read If the fan data becomes 0 between the FANDATAVALID check and the FANPERIODTORPM conversion, it will result in a divide-by-zero crash due to a race with a concurrent...

CVE-2026-74537

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk is currently accessed without either: Task 1 Task 2...

CVE-2026-74538

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isoconnectind Accessing isopisk-conn requires locksock, which is not taken in the "ev3" part of isoconnectind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before...

CVE-2026-74539

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release...

CVE-2026-74534

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of isoconn isoconndel and isochandel have a race that results to double-put of isoconn: Task hdev-workqueue Task 2 isoconndel isochandel isoconnholdunlesszero isoconnlock isoconnlock conn-sk = NULL...

CVE-2026-74533

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs krefgetunlesszero hciconn::isodata is accessed and modified without lock or RCU. This leads to a race Task hdev-workqueue Task 2 isorecv isoconnputconn conn = LOAD hcon-isodata isoconnfreeconn...

CVE-2026-74510

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMTOPPAIRDEVICE command by walking hdev-mgmtpending. The lookup returned a command that was...

CVE-2026-74512

In the Linux kernel, the following vulnerability has been resolved: audit: fix potential use-after-free in auditdelrule auditdelrule destroys e-rule.exe via auditremovemarkrule before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in auditfilte...

CVE-2026-74513

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmbnode in loopback attach/detach/unregister dibsloattachdmb, dibslodetachdmb and dibslounregisterdmb look up the dmbnode under dmbhtlock, drop the lock and only then operate on the node's refcount...

CVE-2026-74506

In the Linux kernel, the following vulnerability has been resolved: afs: Fix UAF when sending a message In afsmakecall, there's a race with async call reception and destruction. If a call is dispatched that doesn't have call-writeiter set used to specify the data content for FS.StoreData, then th...

CVE-2026-74493

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket use-after-free during link group termination smclgrterminate drops connslock after finding a connection in lgr-connsall, but before taking a reference on its socket. The connection is embedded in the socket, a...

CVE-2026-74490

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid use-after-free in poll trace queue dumps TIPC socket tracepoints dump queue state through tipcskdump. Most queue-dump callsites already serialize that walk under the socket lock or sk-sklock.slock, but tipcpoll calls...

CVE-2026-74475

In the Linux kernel, the following vulnerability has been resolved: vxlan: use neighhasnapshot in routeshortcircuit The neighbour hardware address n-ha can be updated asynchronously by the neighbour subsystem, protected by n-halock seqlock. Reading n-ha without holding the seqlock loop can lead t...