CVE-2026-64534

The CVE-2026-64534 issue affects the Linux kernel nvmet-tcp path for NVMe over TCP. A data-digest mismatch could trigger an unconditional nvmet_req_uninit() cleanup, which, if the command arrived via the nvmet_tcp_handle_req_failure() path, results in a refcount underflow and a use-after-free tha...

CVE-2026-64534 nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command arrived via the...

CVE-2026-64321

A flaw was found in the NVMe over RDMA nvmetrdma target in the Linux kernel. When a host queue backlog is exceeded during a connection attempt, a reference count kref is not properly released. This oversight can lead to a resource exhaustion vulnerability, potentially allowing a remote attacker t...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Update of Reference Count (CVE-2026-23414)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505587; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Update of Reference Count (CVE-2026-31391)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505798; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Update of Reference Count (CVE-2026-23391)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505627; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Update of Reference Count (CVE-2026-23321)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505583; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

CVE-2026-64239

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: delete tried region in regionsrmdirs DAMON sysfs maintains the DAMOS tried region directory objects via a linked list. When the user requests refresh of the directories, DAMON sysfs removes all the region...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Update of Reference Count (CVE-2025-39764)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505664; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Update of Reference Count (CVE-2026-23458)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505846; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...

SUSE CVE-2026-64343

In the Linux kernel, the following vulnerability has been resolved: USB: ldusb: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a kr...

SUSE CVE-2026-64345

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fprinter: take kref only for successful open printeropen returns -EBUSY when the character device is already open, but it increments dev-kref regardless of the return value. VFS does not call -release for a failed...

UBUNTU-CVE-2026-64345

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fprinter: take kref only for successful open printeropen returns -EBUSY when the character device is already open, but it increments dev-kref regardless of the return value. VFS does not call -release for a failed...

CVE-2026-64466

CVE-2026-64466 affects the Linux kernel where, in the rust_binder component, a freeze listener may linger in the freeze_listeners red-black tree and the remote node’s listener list after the referenced object’s refcount reaches zero. This can create a refcount cycle and potentially a memory leak....

CVE-2026-64370

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

CVE-2026-64345 usb: gadget: f_printer: take kref only for successful open

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fprinter: take kref only for successful open printeropen returns -EBUSY when the character device is already open, but it increments dev-kref regardless of the return value. VFS does not call -release for a failed...

CVE-2026-64344 USB: idmouse: fix use-after-free on disconnect race

In the Linux kernel, the following vulnerability has been resolved: USB: idmouse: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a...

CVE-2026-64343 USB: ldusb: fix use-after-free on disconnect race

In the Linux kernel, the following vulnerability has been resolved: USB: ldusb: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a kr...

CVE-2026-64341 USB: iowarrior: fix use-after-free on disconnect race

In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use ...

EUVD-2026-48884

In the Linux kernel, the following vulnerability has been resolved: USB: legousbtower: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 U...