EUVD-2026-64574

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach perfgroupdetach handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their groupleader...

CVE-2026-74637

CVE-2026-74637 is a use-after-free in the Linux kernel's perf subsystem . When a perf event group sibling is detached during CPU hotplug (DETACH_GROUP), it is removed from the leader's sibling list but its group_leader pointer is left stale. If the leader is later freed, a PERF_IOC_FLAG_GROUP ioc...

CVE-2026-74634

This vulnerability affects the Linux kernel ring-buffer subsystem. The root cause is that ring_buffer_subbuf_order_set() frees buffer pages even when resizing is disabled, leaving a non-consuming reader exposed to a use-after-free in rb_advance_iter(). The fix returns -EBUSY on resize_disabled, m...

CVE-2026-74634 ring-buffer: Prevent subbuf order change when resizing is disabled

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ringbuffersubbuforderset frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rbadvanceite...

EUVD-2026-64571

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ringbuffersubbuforderset frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rbadvanceite...

CVE-2026-74634 ring-buffer: Prevent subbuf order change when resizing is disabled

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ringbuffersubbuforderset frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rbadvanceite...

EUVD-2026-64568

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smcrxsplice smcrxsplice passes pages to splicetopipe before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splicetopipe may drop...

CVE-2026-74631

CVE-2026-74631 affects the Linux kernel net: smc subsystem, specifically the smc_rx_splice() function. The root cause is a splice entry lifetime imbalance : pages are passed to splice_to_pipe() before the references covering each entry's lifetime are taken. In the VM-backed RMB path, unqueued ent...

CVE-2026-74631 net: smc: fix splice entry lifetime imbalance in smc_rx_splice

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smcrxsplice smcrxsplice passes pages to splicetopipe before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splicetopipe may drop...

CVE-2026-74631 net: smc: fix splice entry lifetime imbalance in smc_rx_splice

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smcrxsplice smcrxsplice passes pages to splicetopipe before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splicetopipe may drop...

CVE-2026-74630 ipv6: prevent in6_dev_get() from resurrecting inet6_dev

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6devget from resurrecting inet6dev in6devget reads dev-ip6ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these operations...

CVE-2026-74630

A use-after-free vulnerability in the Linux kernel's IPv6 subsystem, specifically in in6_dev_get(). The function reads dev->ip6_ptr under RCU and unconditionally increments the refcount, but device teardown can clear the pointer and drop the last reference between these two operations, resurre...

CVE-2026-74630 ipv6: prevent in6_dev_get() from resurrecting inet6_dev

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6devget from resurrecting inet6dev in6devget reads dev-ip6ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these operations...

EUVD-2026-64567

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6devget from resurrecting inet6dev in6devget reads dev-ip6ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these operations...

EUVD-2026-64565

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with modtimer and cancelled with timerdelete, so a pending timer holds no reference on the socket and a cancel does not wait for a callback already...

CVE-2026-74628

CVE-2026-74628 is a use-after-free in the Linux kernel's net/x25 (X.25 protocol) subsystem. The root cause is that x25 timers are armed with mod_timer() and cancelled with timer_delete(), meaning a pending timer holds no reference on the socket. Because x25_heartbeat_expiry() rearms unconditional...

CVE-2026-74628 net/x25: fix use-after-free of the socket by its timers

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with modtimer and cancelled with timerdelete, so a pending timer holds no reference on the socket and a cancel does not wait for a callback already...

CVE-2026-74629 net/dibs: Correct freeing of dmb_clientid_arr

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmbclientidarr A dibs device interrupt handler can be active after dibsdevdel and may still access dmbclientidarr. UAF In case of a failure in dibsdevadd being called by dibslodevprobe dmbclientidarr ...

EUVD-2026-64566

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmbclientidarr A dibs device interrupt handler can be active after dibsdevdel and may still access dmbclientidarr. UAF In case of a failure in dibsdevadd being called by dibslodevprobe dmbclientidarr ...

CVE-2026-74628 net/x25: fix use-after-free of the socket by its timers

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with modtimer and cancelled with timerdelete, so a pending timer holds no reference on the socket and a cancel does not wait for a callback already...