CVE-2026-72085

CVE-2026-72085 concerns the Linux kernel SCSI xen scsiback path. A path in scsiback_get_pend_req() creates a pending command with an uninitialized or not-yet-kref’d se_cmd; if a submission is aborted via a bad grant or unknown ring_req.act, transport_generic_free_cmd() underflows the reference co...

EUVD-2026-59043

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded secmd has only been memset to 0, so its cmdkref is 0; the secmd is...

CVE-2026-72085 scsi: xen: scsiback: Free unsubmitted command instead of double-putting it

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded secmd has only been memset to 0, so its cmdkref is 0; the secmd is...

CVE-2026-72042 ipmi: Fix user refcount underflow in event delivery

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmiallocrecvmsguser takes the temporary user reference owned by the receive message, and ipmifreerecvmsg drops it again. If event delivery fails after allocating receive messag...

CVE-2026-72042

The CVE-2026-72042 entry describes a Linux kernel vulnerability in the IPMI event delivery path. The issue stems from ipmi_alloc_recv_msg(user) taking a temporary user reference and ipmi_free_recv_msg() dropping it again; during rollback, an extra reference drop could free a user still linked in ...

EUVD-2026-59000

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmiallocrecvmsguser takes the temporary user reference owned by the receive message, and ipmifreerecvmsg drops it again. If event delivery fails after allocating receive messag...

CVE-2026-72042 ipmi: Fix user refcount underflow in event delivery

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmiallocrecvmsguser takes the temporary user reference owned by the receive message, and ipmifreerecvmsg drops it again. If event delivery fails after allocating receive messag...

PT-2026-72274

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsiback get pend req obtains a command tag and returns a vscsibk pend whose embedded se cmd has only been memset to 0, so its cmd kref is 0; the se cmd i...

PT-2026-72231

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmi alloc recv msguser takes the temporary user reference owned by the receive message, and ipmi free recv msg drops it again. If event delivery fails after allocating receive...

Linux Distros Unpatched Vulnerability : CVE-2026-72042

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipmi: Fix user refcount underflow in event delivery ipmiallocrecvmsguser takes the temporary user reference owned by the receive message, and ipmifreerecvmsg...

Linux Distros Unpatched Vulnerability : CVE-2026-68263

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/imagination: Fix double call to drmschedentityfini Call sequence of double call: pvrcontextdestroy pvrcontextkillqueues pvrqueuekill drmschedentitydestroy...

CVE-2026-68263

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix double call to drmschedentityfini Call sequence of double call: pvrcontextdestroy pvrcontextkillqueues pvrqueuekill drmschedentitydestroy drmschedentityfini // here pvrcontextput...

CVE-2026-64580

In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device reference with netdevput but leaves xdst-u.dst.dev set. dstdestroy later...

CVE-2026-64534

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command arrived via the...

CVE-2026-64534

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command arrived via the...

CVE-2026-64534

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command arrived via the...

EUVD-2026-49112

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command arrived via the...

PT-2026-64858

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT FAILED before nvmet req uninit in digest error path In nvmet tcp try recv ddgst, when a data digest mismatch is detected, nvmet req uninit is called unconditionally. However, if the command arrived via the...

Linux Distros Unpatched Vulnerability : CVE-2026-64534

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is calle...

SUSE CVE-2026-64467

In the Linux kernel, the following vulnerability has been resolved: rustbinder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array bindersizet = u64 entries, cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry...