CVE-2026-72492

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in sameclienthaslease sameclienthaslease returns an opinfo pointer from ci-moplist after dropping ci-mlock without taking a reference. smbgrantoplock then dereferences that pointer in copylease and when...

CVE-2026-74272

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Resolve region deletion races Sungwoo noticed that the sysfs trigger to delete a region may try to delete a region multiple times. It also has no exclusion relative to the kernel releasing the region via CXL root devi...

CVE-2026-74273

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Block region delete during region creation Expand the range lock, rename it "regionslock", to disable region deletion in the critical period between constructregion and attachtarget, as well as the period between...

CVE-2026-72367

In the Linux kernel, the following vulnerability has been resolved: iomap: guard iosize EOF trim against concurrent truncate underflow iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that iosize tracks only valid data within EOF. This trims iosize when a...

CVE-2026-72422

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn-preauthinfo in concurrent SMB2 NEGOTIATE conn-preauthinfo is shared connection state struct preauthintegrityinfo, kmalloc-96 that is allocated and freed by the SMB2 NEGOTIATE handler and read by...

UBUNTU-CVE-2026-74262

In the Linux kernel, the following vulnerability has been resolved: kcm: use WRITEONCE when changing lower socket callbacks kcmattach replaces a live lower TCP socket's skdataready and skwritespace callbacks with KCM handlers, and kcmunattach restores them later. Those callback-pointer updates ar...

CVE-2026-72121

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcmrxsetup when updating timer and filter content while bcmrxhandler, bcmrxtimeouthandler...

CVE-2026-72118

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN detected a data race within the bcmrxhandler when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. Use atomic operations with...

CVE-2026-68456

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect ueagle-atm uses the asynchronous requestfirmwarenowait in .probe, but does not wait for its completion, not even in .disconnect; so, if the device is unplugged...

CVE-2026-74388 ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data The OSS sequencer processes the input MIDI bytes into a sequencer event to be dispatched later in sndseqossmidiputc called from sndseqossprocessevent. When it's ...

EUVD-2026-59391

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in sameclienthaslease sameclienthaslease returns an opinfo pointer from ci-moplist after dropping ci-mlock without taking a reference. smbgrantoplock then dereferences that pointer in copylease and when...

CVE-2026-72422 ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn-preauthinfo in concurrent SMB2 NEGOTIATE conn-preauthinfo is shared connection state struct preauthintegrityinfo, kmalloc-96 that is allocated and freed by the SMB2 NEGOTIATE handler and read by...

CVE-2026-72422

Summary: CVE-2026-72422 fixes a use-after-free in ksmbd’s handling of conn->preauth_info during concurrent SMB2 NEGOTIATE on the same Linux kernel connection. The issue arose because the preauth_info state (shared across the negotiate and response paths) could be freed while a concurrent send-...

CVE-2026-72392 ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump

In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6: fix NULL deref in fib6walkcontinue on multi-batch dump inet6dumpfib saves its progress in cb-args1 as a positional index within the current hash chain. Between batches, a concurrent fib6newtable can insert a new table...

CVE-2026-72367 iomap: guard io_size EOF trim against concurrent truncate underflow

In the Linux kernel, the following vulnerability has been resolved: iomap: guard iosize EOF trim against concurrent truncate underflow iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that iosize tracks only valid data within EOF. This trims iosize when a...

EUVD-2026-58879

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcmrxsetup when updating timer and filter content while bcmrxhandler, bcmrxtimeouthandler...

CVE-2026-72113

Technical details are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

PT-2026-72902

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpu dpm get pp table returns a pointer to a driver-owned power table after dropping adev-pm.mutex. The sysfs path then copies from that pointer. A concurrent pp table write can replace an...

PT-2026-72883

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

PT-2026-72593

In the Linux kernel, the following vulnerability has been resolved: net: udp tunnel: prevent double queueing in udp tunnel nic device sync Yue Sun reported a use-after-free and debugobjects warning in udp tunnel nic device sync work during concurrent device operations. The workqueue core clears t...