CVE-2026-74727

A race condition in the Linux kernel's ovpn module (in-kernel OpenVPN) causes a Use-After-Free . When a peer is removed concurrently (via OVPN_CMD_PEER_DEL, keepalive expiry, or socket teardown) while ovpn_nl_peer_set_doit() or the float path (ovpn_peer_endpoints_update()) holds only a refcount, ...

CVE-2026-74727 ovpn: skip rehash for peers already removed from by_id

In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from byid ovpnnlpeersetdoit resolves the target peer via ovpnpeergetbyid before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequent...

EUVD-2026-64400

In the Linux kernel, the following vulnerability has been resolved: vhostiotlb: bound map allocation in addrange vhostiotlbaddrangectx only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOSTIOTLBFLAGRETIRE set. Non-retiring tables can keep...

CVE-2026-74674 mm: fix incorrect flush address in direct page table reclaim

In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zappterange reclaims a page table, it does: ptefreetlbtlb, pmdpgtablepmdval, addr; and this is unconditionally wrong: if this code executes, addr always points one...

EUVD-2026-64361

In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zappterange reclaims a page table, it does: ptefreetlbtlb, pmdpgtablepmdval, addr; and this is unconditionally wrong: if this code executes, addr always points one...

CVE-2026-74674 mm: fix incorrect flush address in direct page table reclaim

In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zappterange reclaims a page table, it does: ptefreetlbtlb, pmdpgtablepmdval, addr; and this is unconditionally wrong: if this code executes, addr always points one...

CVE-2026-74674

This vulnerability affects the Linux kernel 's memory management (mm) subsystem, specifically the zap_pte_range function. When reclaiming a page table, the function calls pte_free_tlb with an addr parameter that always points one past the end of the table's range, causing the TLB flush to target ...

EUVD-2026-64359

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire initmm lock on huge vmap to avoid ptdump UAF Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable freeing", v6. Kernel page table walkers fall into two broad categories - those ranges where...

CVE-2026-74672

CVE-2026-74672 is a use-after-free vulnerability in the Linux kernel affecting both x86 and arm64 architectures. The root cause is a race condition between the ptdump page table walker and the vmap huge page table promotion logic: vmap frees lower page tables when promoting to huge leaf entries w...

CVE-2026-74672 mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire initmm lock on huge vmap to avoid ptdump UAF Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable freeing", v6. Kernel page table walkers fall into two broad categories - those ranges where...

CVE-2026-74672 mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire initmm lock on huge vmap to avoid ptdump UAF Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable freeing", v6. Kernel page table walkers fall into two broad categories - those ranges where...

CVE-2026-74662 inet: frags: publish queues before arming timer

In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inetfragcreate arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before th...

EUVD-2026-64536

In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: always stabilise against page table freeing using initmm Previous commits have established the invariant that kernel page table freeing is performed while an mmap read lock on initmm is held, which fixes races between...

CVE-2026-74599

CVE-2026-74599 is a race condition in the Linux kernel 's mm/ptdump subsystem. Previous fixes established that kernel page table freeing occurs while holding an mmap read lock on init_mm , but x86 and arm64 architectures can perform a ptdump over a non-init_mm via ptdump_walk_pgd(). Since kernel ...

CVE-2026-74599 mm/ptdump: always stabilise against page table freeing using init_mm

In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: always stabilise against page table freeing using initmm Previous commits have established the invariant that kernel page table freeing is performed while an mmap read lock on initmm is held, which fixes races between...

CVE-2026-74599 mm/ptdump: always stabilise against page table freeing using init_mm

In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: always stabilise against page table freeing using initmm Previous commits have established the invariant that kernel page table freeing is performed while an mmap read lock on initmm is held, which fixes races between...

CVE-2026-76596

Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table...

CVE-2026-76599

Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik 4.7.2 - The ajaxtables method of the elements model allows listings of arbitrary database tables including columns...

CVE-2026-76596 Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table...

EUVD-2026-64323

Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table...