CVE-2026-74583 net/sched: cls_route: fix fastmap use-after-free on filter

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4filter pointers indexed by id, iif. The reader route4classify populates this cache via...

EUVD-2026-64005

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4filter pointers indexed by id, iif. The reader route4classify populates this cache via...

EUVD-2026-64003

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6rulesuppress drops a suppressed route with ip6rtputflags, but leaves res-rt6 pointing at the released rt6info. If no later rule supplies a replacement, fib6rulelookup still sees...

CVE-2026-74581

This vulnerability affects the Linux kernel IPv6 FIB rule suppression path. The function fib6_rule_suppress() releases a suppressed route via ip6_rt_put_flags() but fails to clear res->rt6, leaving it pointing at the already-freed rt6_info structure. If no subsequent rule provides a replacemen...

CVE-2026-39909

llama.cpp before build b8585 contains a use-after-free vulnerability in the RPC server's GRAPH_RECOMPUTE handler. An unauthenticated remote attacker can store a computation graph, cause referenced buffers to be freed, then reclaim that memory with attacker-controlled content. Sending a subsequent...

CVE-2026-39909 llama.cpp Use-After-Free in RPC GRAPH_RECOMPUTE Handler

llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPHRECOMPUTE handler that allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with...

EUVD-2026-64001

llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPHRECOMPUTE handler that allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with...

CVE-2026-39909

llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPHRECOMPUTE handler that allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with...

CVE-2026-39909 llama.cpp Use-After-Free in RPC GRAPH_RECOMPUTE Handler

llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPHRECOMPUTE handler that allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with...

CVE-2026-39909 llama.cpp Use-After-Free in RPC GRAPH_RECOMPUTE Handler

llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPHRECOMPUTE handler that allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with...

CVE-2026-74518

A flaw was found in the Linux kernel. The allocatefileregionentries function, responsible for managing huge page memory regions, can suffer from list corruption. This occurs because the listsplice operation does not properly re-initialize a list head, allowing concurrent access to shared memory...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

CVE-2026-74575

A flaw was found in the Thunderbolt XDomain driver of the Linux kernel. A race condition can occur during the removal of a Thunderbolt cross-domain device XDomain. This allows a delayed work item to be queued after its cancellation but before the XDomain object is freed, leading to a use-after-fr...

CVE-2026-74548

A flaw was found in the forcedeth component of the Linux kernel. The nvremove function frees the per-CPU txrxstats before unregisternetdev completes. This timing issue allows other functions, such as ndogetstats64, the NAPI/xmit data path, and nvclose/drain, to access the freed memory, leading to...

CVE-2026-74540

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. A use-after-free UAF vulnerability exists in the l2capleconnectrsp function, where a channel can be freed while still being referenced. This can be triggered by a remote disconnect,...

CVE-2026-74534

A flaw was found in the Linux kernel's Bluetooth ISO subsystem. A race condition between isoconndel and isochandel functions can lead to a double-put of isoconn objects. This can result in a Use-After-Free UAF vulnerability, potentially allowing an attacker to cause a denial of service or achieve...

CVE-2026-74441

A flaw was found in the Linux kernel's USB Type-C UCSI driver. This vulnerability arises from a timing issue during the unregistration of USB Type-C ports, where certain operations can race against the destruction of internal work queues. A local attacker could exploit this race condition to...

CVE-2026-74490

A flaw was found in the Linux kernel's TIPC Transparent Inter-Process Communication module. A race condition exists in the tipcpoll function when dumping trace queue state, as it does not properly hold necessary locks. This allows a local attacker to trigger a use-after-free vulnerability by...

CVE-2026-74478

A flaw was found in the Linux kernel. A remote attacker, by sending specially crafted packets over GRE or L2TPv3 transports, could trigger a use-after-free vulnerability. This occurs in the vectormmsgrx function when a packet's overlay header fails verification, causing the system to attempt to...

CVE-2026-74465

A flaw was found in the Linux kernel's Open vSwitch OVS component. When a new meter is attached, the attachmeter function makes it visible to other central processing units CPUs before all checks are complete. If the attachment fails, the meter is freed without waiting for other CPUs to stop usin...