UBUNTU-CVE-2026-74637

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach perfgroupdetach handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their groupleader...

UBUNTU-CVE-2026-74589

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...

UBUNTU-CVE-2026-74609

In the Linux kernel, the following vulnerability has been resolved: tipc: read le-link under the node lock in tipcnodelinkdown tipcnodelinkdown caches the link pointer before taking n-lock: struct tipclink l = le-link; / unlocked / if !l return; tipcnodewritelockn; if !tipclinkisestablishingl /...

CVE-2026-74731 sched_ext: Skip sub-disable teardown for never-linked sub-schedulers

In the Linux kernel, the following vulnerability has been resolved: schedext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scxlinksched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs th...

EUVD-2026-64418

In the Linux kernel, the following vulnerability has been resolved: schedext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scxlinksched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs th...

CVE-2026-74731

CVE-2026-74731 is a use-after-free vulnerability in the Linux kernel's sched_ext (extensible scheduler) component. When a sub-scheduler enable fails before scx_link_sched() links it into the hierarchy, the cleanup path still runs the full scx_sub_disable(). This creates a race against root disabl...

CVE-2026-74731 sched_ext: Skip sub-disable teardown for never-linked sub-schedulers

In the Linux kernel, the following vulnerability has been resolved: schedext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scxlinksched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs th...

CVE-2026-74730 NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfsserver' during a FREESTATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREESTATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct...

CVE-2026-74730 NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfsserver' during a FREESTATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREESTATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct...

CVE-2026-74730

CVE-2026-74730 is a use-after-free vulnerability in the Linux kernel NFS subsystem . When a FREE_STATEID operation is delayed, the struct nfs_server object can be freed while operations are still in flight, leading to memory corruption. The fix bumps the refcount of struct nfs_server for the dura...

EUVD-2026-64417

In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfsserver' during a FREESTATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREESTATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct...

CVE-2026-74727

A race condition in the Linux kernel's ovpn module (in-kernel OpenVPN) causes a Use-After-Free . When a peer is removed concurrently (via OVPN_CMD_PEER_DEL, keepalive expiry, or socket teardown) while ovpn_nl_peer_set_doit() or the float path (ovpn_peer_endpoints_update()) holds only a refcount, ...

CVE-2026-74727 ovpn: skip rehash for peers already removed from by_id

In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from byid ovpnnlpeersetdoit resolves the target peer via ovpnpeergetbyid before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequent...

CVE-2026-74727 ovpn: skip rehash for peers already removed from by_id

In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from byid ovpnnlpeersetdoit resolves the target peer via ovpnpeergetbyid before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequent...

EUVD-2026-64414

In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from byid ovpnnlpeersetdoit resolves the target peer via ovpnpeergetbyid before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequent...

EUVD-2026-64412

In the Linux kernel, the following vulnerability has been resolved: enic: fix txhangreset use-after-free on device removal enicremove cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that fires while the device is being removed can schedule enictxhangreset s...

CVE-2026-74725 enic: fix tx_hang_reset use-after-free on device removal

In the Linux kernel, the following vulnerability has been resolved: enic: fix txhangreset use-after-free on device removal enicremove cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that fires while the device is being removed can schedule enictxhangreset s...

CVE-2026-74725

A use-after-free vulnerability exists in the Linux kernel enic driver during device removal. The function enic_remove() cancels the reset and change_mtu_work items but fails to cancel tx_hang_reset. A TX timeout firing while the device is being removed can schedule enic_tx_hang_reset() to execute...

CVE-2026-74725 enic: fix tx_hang_reset use-after-free on device removal

In the Linux kernel, the following vulnerability has been resolved: enic: fix txhangreset use-after-free on device removal enicremove cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that fires while the device is being removed can schedule enictxhangreset s...

CVE-2026-74714

A use-after-free vulnerability in the Linux kernel BPF TCP iterator, specifically in bpf_iter_tcp_established_batch(). The root cause is a race condition: sock_hold() increments the reference count of a request_sock whose rsk_refcnt is still zero at publish time, and the subsequent refcount_set(3...