EUVD-2026-59430

In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAPNETADMIN when an operation sets GENLADMINPERM or...

CVE-2026-72449 drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadata without removing it from the list. The list head is left pointing a...

EUVD-2026-59348

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadata without removing it from the list. The list head is left pointing a...

CVE-2026-72449

CVE-2026-72449 : A Linux kernel flaw in drm/amdkfd causing list_del corruption during kfd_criu_resume_svm cleanup, leaving freed objects on the criu_svm_metadata_list. An unprivileged render-group user could trigger a use-after-free/double-free path via /dev/kfd. The fix adds list_del() before kf...

CVE-2026-72449 drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadata without removing it from the list. The list head is left pointing a...

CVE-2026-72446

CVE-2026-72446 affects the Linux kernel ALSA: usb-audio on Qualcomm, where disable requests could dereference a negative info_idx on the disable path in handle_uaudio_stream_req(), causing memory corruption (read/write) when a stream was never enabled or when the interface doesn’t match. The vuln...

CVE-2026-72446 ALSA: usb-audio: qcom: reject stream disable with no active interface

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: reject stream disable with no active interface handleuaudiostreamreq resolves an interface index with infoidxfromifnum, which returns -EINVAL when no interface matches. The enable branch and the response:...

EUVD-2026-59161

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

CVE-2026-72262 ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

CVE-2026-72262 ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

CVE-2026-72192 ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...

CVE-2026-72071 tracing/user_events: Fix use-after-free in user_event_mm_dup()

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Fix use-after-free in usereventmmdup usereventmmdup walks the parent mm's enabler list locklessly under rcureadlock during fork from copyprocess; it does not take eventmutex: rcureadlock;...

CVE-2026-72049 ieee802154: admin-gate legacy LLSEC dump operations

In the Linux kernel, the following vulnerability has been resolved: ieee802154: admin-gate legacy LLSEC dump operations In net/ieee802154/netlink.c, the legacy IEEE802154NL family ops table builds the LLSEC dump entries LLSECLISTKEY, LLSECLISTDEV, LLSECLISTDEVKEY, LLSECLISTSECLEVEL with...

PT-2026-72637

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix list del corruption in kfd criu resume svm The cleanup tail of kfd criu resume svm walks svms-criu svm metadata list and kfrees each struct criu svm metadata without removing it from the list. The list head is lef...

Linux Distros Unpatched Vulnerability : CVE-2026-74544

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: clsu32: validate offshift to prevent shift-out-of-bounds u32change copies the user-provided tcu32sel.offshift unsigned char, 0-255 into the kernel...

PT-2026-72996

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls u32: validate offshift to prevent shift-out-of-bounds u32 change copies the user-provided tc u32 sel.offshift unsigned char, 0-255 into the kernel knode object without bounds validation. When a packet later hits u3...

PT-2026-72380

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound to move in indx insert into root before hdr insert head indx insert into root promotes a full resident $INDEX ROOT into $INDEX ALLOCATION and copies all non-last resident root entries into a newly allocated INDEX...

PT-2026-72450

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytes ext put/get The ipc control data buffer is allocated as kzallocmax size, where max size covers the entire struct sof ipc ctrl data including its flexible array payload. However,...

PT-2026-72956

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initialize timer A userspace-driven ALSA timer SND UTIMER lets an unprivileged user set the backing snd timer's hardware resolution to an arbitrary 64-bit value via SNDRV TIMER IOCTL CREATE. snd...

PT-2026-72260

In the Linux kernel, the following vulnerability has been resolved: tracing/user events: Fix use-after-free in user event mm dup user event mm dup walks the parent mm's enabler list locklessly under rcu read lock during fork from copy process; it does not take event mutex: rcu read lock; list for...