scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()

...

UBUNTU-CVE-2026-23212

In the Linux kernel, the following vulnerability has been resolved: bonding: annotate data-races around slave-lastrx slave-lastrx and slave-targetlastarprx... can be read and written locklessly. Add READONCE and WRITEONCE annotations. syzbot reported: BUG: KCSAN: data-race in bondrcvvalidate /...

CVE-2026-23224

CVE-2026-23224 relates to the Linux kernel EROFS UAF race on file-backed mounts with the directio option. The issue arises in a race between z_erofs_read_folio, erofs_fileio_submit_bio, and related IO workqueue paths, where a dio ki_complete path frees an iocb/rq while access to the underlying fi...

CVE-2025-71229

CVE-2025-71229 is a Linux kernel vulnerability affecting the rtw88 Wi‑Fi driver (rtw_core_enable_beacon). The issue arises when the function reads 4 bytes from a non-4-byte-aligned address, which can trigger an alignment fault and crash the kernel on some systems. The fixed patch changes the acce...

CVE-2025-71229 wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix alignment fault in rtwcoreenablebeacon rtwcoreenablebeacon reads 4 bytes from an address that is not a multiple of 4. This results in a crash on some systems. Do 1 byte reads/writes instead. Unable to handle kern...

CVE-2026-23217 riscv: trace: fix snapshot deadlock with sbi ecall

In the Linux kernel, the following vulnerability has been resolved: riscv: trace: fix snapshot deadlock with sbi ecall If sbiecall.c's functions are traceable, echo "sbiecall:snapshot" /sys/kernel/tracing/setftracefilter may get the kernel into a deadlock. Functions in sbiecall.c are excluded fro...

SUSE CVE-2026-23197

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: preserve error state in block data length handler When a block read returns an invalid length, zero or I2CSMBUSBLOCKMAX, the length handler sets the state to IMXI2CSTATEFAILED. However, i2cimxmasterisr unconditionally...

Linux Distros Unpatched Vulnerability : CVE-2026-23166

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ice: Fix NULL pointer dereference in icevsisetnapiqueues Add NULL pointer checks in icevsisetnapiqueues to prevent crashes during resume from suspend when...

CVE-2026-23207

In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Protect currxfer check in IRQ handler Now that all other accesses to currxfer are done under the lock, protect the currxfer NULL check in tegraqspiisrthread with the spinlock. Without this protection, the...

CVE-2026-23197

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: preserve error state in block data length handler When a block read returns an invalid length, zero or I2CSMBUSBLOCKMAX, the length handler sets the state to IMXI2CSTATEFAILED. However, i2cimxmasterisr unconditionally...

UBUNTU-CVE-2026-23183

In the Linux kernel, the following vulnerability has been resolved: cgroup/dmem: fix NULL pointer dereference when setting max An issue was triggered: BUG: kernel NULL pointer dereference, address: 0000000000000000 PF: supervisor read access in kernel mode PF: errorcode0x0000 - not-present page P...

CVE-2026-23208

CVE-2026-23208 — Linux kernel ALSA USB audio OOB write fix . The issue arose when user-provided ALSA USB audio parameters led to an out-of-bounds write: calculated frames (packsize[0] * packets) exceeded URB buffer, triggering KASAN slab-out-of-bounds in sound/usb/pcm.c. The patch adds a safety c...

EUVD-2026-5844

In the Linux kernel, the following vulnerability has been resolved: ceph: fix oops due to invalid pointer for kfree in parselongname This fixes a kernel oops when reading ceph snapshot directories .snap, for example by simply running ls /mnt/myceph/.snap. The variable str is guarded by freekfree,...

CVE-2026-23200 ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix ECMP sibling count mismatch when clearing RTFADDRCONF syzbot reported a kernel BUG in fib6addrt2node when adding an IPv6 route. 0 Commit f72514b3c569 "ipv6: clear RA flags when adding a static route" introduced logic to...

CVE-2026-23197

The CVE-2026-23197 issue affects the Linux kernel i2c_imx driver: when a block read returns an invalid length (not in range), the length handler sets IMX_I2C_STATE_FAILED, but i2c_imx_master_isr() overwrites it with IMX_I2C_STATE_READ_CONTINUE, causing an endless read loop that overruns buffers a...

CVE-2026-23195 cgroup/dmem: avoid pool UAF

In the Linux kernel, the following vulnerability has been resolved: cgroup/dmem: avoid pool UAF An UAF issue was observed: BUG: KASAN: slab-use-after-free in pagecounteruncharge+0x65/0x150 Write of size 8 at addr ffff888106715440 by task insmod/527 CPU: 4 UID: 0 PID: 527 Comm: insmod...

CVE-2026-23193 scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsitdecsessionusagecount In iscsitdecsessionusagecount, the function calls complete while holding the sess-sessionusagelock. Similar to the connection usage count logic, the waiter...

CVE-2026-23192 linkwatch: use __dev_put() in callers to prevent UAF

In the Linux kernel, the following vulnerability has been resolved: linkwatch: use devput in callers to prevent UAF After linkwatchdodev calls devput to release the linkwatch reference, the device refcount may drop to 1. At this point, netdevruntodo can proceed since linkwatchsyncdev sees an empt...

CVE-2026-23192

In the Linux kernel, the following vulnerability has been resolved: linkwatch: use devput in callers to prevent UAF After linkwatchdodev calls devput to release the linkwatch reference, the device refcount may drop to 1. At this point, netdevruntodo can proceed since linkwatchsyncdev sees an empt...

EUVD-2026-5854

In the Linux kernel, the following vulnerability has been resolved: ceph: fix NULL pointer dereference in cephmdsauthmatch The CephFS kernel client has regression starting from 6.18-rc1. We have issue in cephmdsauthmatch if fsname == NULL: const char fsname = mdsc-fsc-mountoptions-mdsnamespace;...