CVE-2026-64120 net: ethtool: fix NULL pointer dereference in phy_reply_size

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: fix NULL pointer dereference in phyreplysize In phypreparedata, several strings such as 'name', 'drvname', 'upstreamsfpname', and 'downstreamsfpname' are allocated using kstrdup. However, these allocations were not...

CVE-2026-64115

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmcitransportrecvconnectingserver returned err = 0 for a peer RST in its default switch arm: err = pkt-type == VMCITRANSPORTPACKETTYPERST ? 0 : -EINVAL; That made...

CVE-2026-64113

In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevfcleanrxirq prunes frames whose source MAC matches the VF's own address VEPA multicast workaround by freeing the skb and continuing to the next descriptor:...

CVE-2026-64105

The CVE-2026-64105 entry concerns Linux kernel KVM for ARM64 vgic: when a vCPU fails to initialize, private IRQs allocated prior to a redistributor iodev registration are not released, causing a resource leak. The root cause is a missing cleanup path in kvm_arch_vcpu_create() and the preceding kv...

CVE-2026-64105

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Free privateirqs when init fails after allocation Companion to commit 250f25367b58 "KVM: arm64: Tear down vGIC on failed vCPU creation", which added the missing kvmvgicvcpudestroy call to the kvmsharehyp failure...

CVE-2026-64105

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Free privateirqs when init fails after allocation Companion to commit 250f25367b58 "KVM: arm64: Tear down vGIC on failed vCPU creation", which added the missing kvmvgicvcpudestroy call to the kvmsharehyp failure...

CVE-2026-64105 KVM: arm64: vgic: Free private_irqs when init fails after allocation

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Free privateirqs when init fails after allocation Companion to commit 250f25367b58 "KVM: arm64: Tear down vGIC on failed vCPU creation", which added the missing kvmvgicvcpudestroy call to the kvmsharehyp failure...

CVE-2026-64095

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid double decrement of bla.numrequests The bla.numrequests is increased when no requestsent was in progress. And it is decremented in various places announcement was received, backbone is purged, periodic work...

CVE-2026-64095

Concrete details confirm CVE-2026-64095 affects Linux kernel batman-adv (bla.num_requests) where double decrement occurs due to non-atomic checks of request_sent and bla.num_requests. The root cause: several code paths modify state and counts without atomic synchronization, allowing TOCTOU races....

CVE-2026-64095 batman-adv: bla: avoid double decrement of bla.num_requests

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid double decrement of bla.numrequests The bla.numrequests is increased when no requestsent was in progress. And it is decremented in various places announcement was received, backbone is purged, periodic work...

CVE-2026-64093

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: directly shut down timer on cleanup batadvtpsendercleanup was calling timerdeletesync followed by timerdelete to guard against the timer handler re-arming itself between the two calls. This double-deletion ha...

EUVD-2026-45778

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: directly shut down timer on cleanup batadvtpsendercleanup was calling timerdeletesync followed by timerdelete to guard against the timer handler re-arming itself between the two calls. This double-deletion ha...

CVE-2026-64093 batman-adv: tp_meter: directly shut down timer on cleanup

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: directly shut down timer on cleanup batadvtpsendercleanup was calling timerdeletesync followed by timerdelete to guard against the timer handler re-arming itself between the two calls. This double-deletion ha...

CVE-2026-64093

The CVE concerns batman-adv (Linux kernel) where tp_meter cleanup caused a potential re-arm of a timer due to two-step deletion. batadv_tp_sender_cleanup() called timer_delete_sync() followed by timer_delete(); the fix replaces both calls with a single timer_shutdown_sync() that waits for any run...

EUVD-2026-45627

In the Linux kernel, the following vulnerability has been resolved: net: shaper: reject duplicate leaves in GROUP request netshapernlgroupdoit does not deduplicate NETSHAPERALEAVES entries. When userspace supplies the same leaf handle twice, the same old-parent pointer lands twice in oldnodes. Th...

CVE-2026-64054

In the Linux kernel, the following vulnerability has been resolved: net: shaper: reject duplicate leaves in GROUP request netshapernlgroupdoit does not deduplicate NETSHAPERALEAVES entries. When userspace supplies the same leaf handle twice, the same old-parent pointer lands twice in oldnodes. Th...

CVE-2026-64038 hwmon: (lm90) Stop work before releasing hwmon device

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Stop work before releasing hwmon device Sashiko reports: In lm90probe, the devm action to cancel the alertwork and reportwork lm90restoreconf is registered in lm90initclient before devmhwmondeviceregisterwithinfo is...

CVE-2026-64038 hwmon: (lm90) Stop work before releasing hwmon device

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Stop work before releasing hwmon device Sashiko reports: In lm90probe, the devm action to cancel the alertwork and reportwork lm90restoreconf is registered in lm90initclient before devmhwmondeviceregisterwithinfo is...

CVE-2026-64035

The CVE-2026-64035 entry concerns the Linux kernel igc driver: igc_fpe_init_smd_frame() failed to set the tx buffer type for SMD frames, causing igc_tx_buffer entries to retain a stale XDP/XSK type. This can lead TX completion to follow an incorrect cleanup path. The fix is to set the buffer type...

EUVD-2026-45608

In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igcfpeinitsmdframe initializes igctxbuffer fields for an SMD skb, but does not set the buffer type:...