PT-2026-72989

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in iso conn ready sk deref in iso conn ready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk is currently accessed without either: Task 1 Task 2 iso...

PT-2026-72271

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix refcount leak in efct hw io abort When efct hw reqtag alloc fails in efct hw io abort, the error path returns -ENOSPC without releasing the reference obtained via kref get unless zero earlier in the function...

PT-2026-72370

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: fix refcount leak in is full charged In is full charged, power supply get by name is called to obtain a reference to the fuel gauge power supply. If the voltage check uV = desc-fullbatt uV succeeds...

Linux Distros Unpatched Vulnerability : CVE-2026-74264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: watchdog: fix refcount tracking races Blamed commit converted the untracked devhold/devput calls in the watchdog code to use the tracked...

PT-2026-72649

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the sk ctx Currently update sk ctx transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller conditionally put the...

PT-2026-72495

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw sp vrs lpm tree replace When mlxsw sp vrs lpm tree replace fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the...

Linux Distros Unpatched Vulnerability : CVE-2026-72113

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: bcm: add missing device refcount for CAN filter removal sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is...

PT-2026-72783

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nf ct timeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being us...

PT-2026-72527

In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on build skb failure qede rx build skb and qede tpa rx build skb do not check for a NULL return from qede build skb. When it returns NULL under memory pressure, the functions still...

PT-2026-72231

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmi alloc recv msguser takes the temporary user reference owned by the receive message, and ipmi free recv msg drops it again. If event delivery fails after allocating receive...

PT-2026-72478

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix GISC refcount leak on AIF enable failure kvm s390 gisc register registers the guest ISC before pinning the guest interrupt forwarding pages and allocating the AISB bit. If any of the later setup steps fails, t...

PT-2026-72406

In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm file refcount leak on cached nlm do fopen failure The cached-file path in nlm lookup file reaches the found: label unconditionally, even when nlm do fopen fails. At that label result and file-f count are updated...

PT-2026-72752

In the Linux kernel, the following vulnerability has been resolved: NFSD: Handle layout stid in nfsd4 drop revoked stid nfsd4 drop revoked stid has no SC TYPE LAYOUT case, so when a client sends FREE STATEID for an admin-revoked layout stid, the default branch releases cl lock and returns without...

PT-2026-72211

In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llc ui autobind llc ui autobind opens a SAP after choosing a dynamic LSAP. llc sap open returns a reference owned by the caller, and llc sap add socket takes a second reference for the socket's...

Linux Distros Unpatched Vulnerability : CVE-2026-74405

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OPP: Fix race between OPP addition and lookup A race exists between devpmoppadddynamic and devpmoppfindfreqexact: CPU0 add CPU1 lookup...

PT-2026-72965

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmb node in loopback attach/detach/unregister dibs lo attach dmb, dibs lo detach dmb and dibs lo unregister dmb look up the dmb node under dmb ht lock, drop the lock and only then operate on the node's...

PT-2026-72443

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf queue: pin bridge device while NFQUEUE holds fake dst The br netfilter fake rtable is embedded in struct net bridge and is attached to bridged packets with skb dst set noref. If such a packet is queued to NFQUEUE, n...

PT-2026-72317

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix refcount leak in nvmet sq create In nvmet sq create, a reference on the ctrl is taken via kref get unless zero before calling nvmet check sqid. If nvmet check sqid fails, the function returns the error directly without...

PT-2026-72724

In the Linux kernel, the following vulnerability has been resolved: net: fib rules: Don't dump dying fib rule in fib rules dump. rocker router fib event calls fib rule get during RCU dump. If the fib rule is dying, refcount inc will complain about it. Let's call refcount inc not zero in fib rules...

Linux Distros Unpatched Vulnerability : CVE-2026-72042

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipmi: Fix user refcount underflow in event delivery ipmiallocrecvmsguser takes the temporary user reference owned by the receive message, and ipmifreerecvmsg...