CVE-2026-10681 SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot

In Zephyr's userspace dynamic-objects subsystem, threadidxalloc in kernel/userspace/userspace.c allocated a new thread permission index from the global threadidxmap bitmap without holding listslock. On SMP systems, two user-mode threads invoking the kobjectallocKOBJTHREAD syscall concurrently can...

CVE-2026-64438

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adfdisablesriov The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state struct adfaccelvfinfo. Currently, adfdisablesriov destroys per-VF...

CVE-2026-64375

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second...

CVE-2026-64378

In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroupwritebackumount and inodeswitchwbs When a container exits, the following BUGON is occasionally triggered: ================================================================== VFS: Busy inodes after...

CVE-2026-64260

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue-stopped races and set/read that value under lock There are several readers of queue-stopped that check the value under lock, but fuseuringcommitfetch did not and actually the value was not set under the lo...

UBUNTU-CVE-2026-64260

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue-stopped races and set/read that value under lock There are several readers of queue-stopped that check the value under lock, but fuseuringcommitfetch did not and actually the value was not set under the lo...

UBUNTU-CVE-2026-64496

In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor with anoninodegetfd, which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the calle...

UBUNTU-CVE-2026-64375

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second...

CVE-2026-64496

In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor with anoninodegetfd, which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the calle...

EUVD-2026-48840

In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor with anoninodegetfd, which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the calle...

CVE-2026-64496

The CVE-2026-64496 issue affects the Linux kernel IIO event (iio: event) where a race between kfifo_to_user and kfifo_reset_out could lead to an out-of-bounds read and leakage of kernel memory to userspace. Root cause: iio_event_getfd() uses anon_inode_getfd() to allocate and install a new FD, th...

CVE-2026-64472 vfio/mlx5: Fix racy bitfields and tighten struct layout

In the Linux kernel, the following vulnerability has been resolved: vfio/mlx5: Fix racy bitfields and tighten struct layout Bitfield operations are not atomic, they use a read-modify-write pattern, therefore we should be careful not to pack bitfields that can be concurrently updated into the same...

EUVD-2026-48782

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adfdisablesriov The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state struct adfaccelvfinfo. Currently, adfdisablesriov destroys per-VF...

EUVD-2026-48769

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: re-check IOWQBITEXIT for each linked work item commit 10dc95939817 "iouring/io-wq: check IOWQBITEXIT inside work run loop" fixed the obvious case where ioworkerhandlework took one exit-bit snapshot before draining...

CVE-2026-64425

CVE-2026-64425 affects the Linux kernel io_uring/io-wq component. The vulnerability arises from where io_worker_handle_work() snapshots IO_WQ_BIT_EXIT and only later re-checks it inside the outer work loop, allowing linked work items to run after exit has begun if IO_WQ_BIT_EXIT is set post-start...

CVE-2026-64418

CVE-2026-64418 is a Linux kernel memory-management race in the shrinker subsystem. The vulnerability arises when the shrinker_info array is freed while still accessible, causing use-after-free or double-free. The root cause is that alloc_shrinker_info() can drop shrinker_mutex before finishing in...

CVE-2026-64418 mm: shrinker: fix shrinker_info teardown race with expansion

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix shrinkerinfo teardown race with expansion expandshrinkerinfo iterates all visible memcgs under shrinkermutex, including memcgs that have not finished -cssonline yet. Once pn-shrinkerinfo has been published,...

EUVD-2026-48922

In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroupwritebackumount and inodeswitchwbs When a container exits, the following BUGON is occasionally triggered: ================================================================== VFS: Busy inodes after...

CVE-2026-64378

CVE-2026-64378 is a Linux kernel race between cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb() triggered when a container exits. The root cause is a window between inode_prepare_wbs_switch() returning true and wb_queue_isw(), which can lead to a VFS: Busy inodes after unmou...

CVE-2026-64378 writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()

In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroupwritebackumount and inodeswitchwbs When a container exits, the following BUGON is occasionally triggered: ================================================================== VFS: Busy inodes after...