EUVD-2026-45800

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmcitransportrecvconnectingserver returned err = 0 for a peer RST in its default switch arm: err = pkt-type == VMCITRANSPORTPACKETTYPERST ? 0 : -EINVAL; That made...

CVE-2026-64113 ixgbevf: fix use-after-free in VEPA multicast source pruning

In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevfcleanrxirq prunes frames whose source MAC matches the VF's own address VEPA multicast workaround by freeing the skb and continuing to the next descriptor:...

CVE-2026-64100 drm/msm: Fix shrinker deadlock

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix shrinker deadlock With PROVELOCKING on an Snapdragon X1 and VM reclaim pressure, we see: ====================================================== WARNING: possible circular locking dependency detected 7.0.0-debug+ 43...

EUVD-2026-45777

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: fix tpvars reference leak in receiver shutdown The receiver shutdown timer handler, batadvtpreceivershutdown, is responsible for releasing the tpvars reference it holds. However, the existing logic for...

CVE-2026-64089 batman-adv: tt: fix negative last_changeset_len

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative lastchangesetlen batadvpivtt::lastchangesetlen len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative...

CVE-2026-64087 hwmon: (pmbus/adm1266) reject implausible blackbox record_count

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 reject implausible blackbox recordcount adm1266nvmemreadblackbox loops over a recordcount that comes straight from byte 3 of the BLACKBOXINFO response. The destination buffer is data-devmem, sized for the nvm...

CVE-2026-64085

CVE-2026-64085 is a buffer overflow in the Linux kernel's hwmon (pmbus/adm1266) driver. The helper adm1266_pmbus_block_xfer() trusts the device-supplied length and can write up to 255 bytes , but adm1266_nvmem_read_blackbox() advances in 64-byte strides within a 2048-byte dev_mem buffer. On the t...

CVE-2026-64075

CVE-2026-64075 is a use-after-free vulnerability in the Linux kernel's fprobe subsystem (part of KProbes tracing). The root cause is that commit 4346ba1604093 rewrote fprobe on the function-graph tracer to use an RCU hash list but forgot to wait for an RCU grace period in unregister_fprobe(), all...

CVE-2026-64073

Summary of CVE-2026-64073 (Linux kernel): A use-after-free in irq_work_single() on PREEMPT_RT was fixed. On PREEMPT_RT, non-HARD irq_work runs in per-CPU kthreads via run_irq_workd(), and irq_work_sync() uses rcuwait() to wait for BUSY==0. After irq_work_single() clears BUSY with atomic_cmpxchg()...

EUVD-2026-45644

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix use-after-free in nvmefreehostmem nvmefreehostmem frees dev-hmbsgt via dmafreenoncontiguous but never clears the pointer afterward. This leads to a use-after-free if nvmefreehostmem is called twice in the same error...

CVE-2026-64066 netfs: Fix netfs_read_to_pagecache() to pause on subreq failure

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfsreadtopagecache to pause on subreq failure Fix netfsreadtopagecache so that it pauses the generation of new subrequests if an already-issued subrequest fails...

CVE-2026-64063 netfs: Fix streaming write being overwritten

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix streaming write being overwritten In order to avoid reading whilst writing, netfslib will allow "streaming writes" in which dirty data is stored directly into folios without reading them first. Such folios are marked...

CVE-2026-64061

The CVE-2026-64061 entry concerns a use-after-free in the Linux kernel netfs layer (netfs_read_gaps) where the sink page is prematurely released during a network read, enabling memory corruption. The issue was observed via KASAN in a cifsd-based trace and is described across multiple vendors (Red...

EUVD-2026-45629

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmacrx is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device ...

CVE-2026-64040 cachefiles: Fix error return when vfs_mkdir() fails

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix error return when vfsmkdir fails When vfsmkdir fails, the error code is not extracted from the returned error pointer. This causes mkdirerror to be reached with ret=0, which leads to returning ERRPTR0 NULL instead...

CVE-2026-64034 net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwcmsgid from DMA buffer In manahwcrxeventhandler, resp-response.hwcmsgid is read from DMA-coherent memory and bounds-checked, then manahwchandleresp re-reads the same field from the same DMA...

CVE-2026-64034

The CVE concerns the Linux kernel net: mana TOCTOU in hwc_msg_id handling. In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arit...

CVE-2026-64033

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrssrvcreatepathfiles, the sysfs root folders may already have been created and srvpath-kobj may already have been initialized. If a later step...

CVE-2026-64026 rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix DATA decrypt vs splice by copying data to buffer in recvmsg This improves the fix for CVE-2026-43500. Fix the pagecache corruption from in-place decryption of a DATA packet transmitted locally by splice by getting rid ...

CVE-2026-64025 bpf, skmsg: fix verdict sk_data_ready racing with ktls rx

In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict skdataready racing with ktls rx skpsockstrpdataready already checks tlsswhasctxrx and defers to psock-saveddataready when a TLS RX context is present, avoiding a conflict with the TLS strparser's ownership...