Linux Distros Unpatched Vulnerability : CVE-2026-74313

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vduse: hold vduselock across IDR lookup in open path vdusedevopen looks up struct vdusedev through the IDR and then acquires dev-lock only after vduselock has...

CVE-2026-74370 liveupdate: fix TOCTOU race in luo_session_retrieve()

In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix TOCTOU race in luosessionretrieve Extend the scope of the rwsemread lock in luosessionretrieve to overlap with the acquisition of the session mutex. This prevents a concurrent thread from releasing and freeing the...

EUVD-2026-59419

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Resolve region deletion races Sungwoo noticed that the sysfs trigger to delete a region may try to delete a region multiple times. It also has no exclusion relative to the kernel releasing the region via CXL root devi...

PT-2026-72529

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix publication race for priv-channel stats mlx5e channel stats alloc publishes a new entry to priv-channel stats and then increments priv-stats nch as a publication token, but neither store carries any memory barrier:...

EUVD-2026-55538

In the Linux kernel, the following vulnerability has been resolved: amt: fix use-after-free in AMT delayed works When an AMT device is removed, pending delayed works can still access the freed amtdev structure, which may result in kernel crashes or memory corruption. amtdevstop cancels reqwq and...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: GPU: host1x – Fixed a race condition in syncptalloc and syncptfree. A race condition occurred between host1xsyncptalloc and host1xsyncptput, which was addressed by using krefputmutex instead of krefput plus manual mutex locking...

Exploit for CVE-2026-64600

VQ-RefluxCore: Kernel Vulnerability Assessment & Research Fram...

CVE-2026-63977

A flaw was found in the Linux kernel's dpll: zl3073x module. A race condition can occur during device teardown when a changework operation is re-scheduled after a cancelworksync call. This can lead to the system attempting to access a memory location that has been freed or is invalid, potentially...

CVE-2026-64056 net: ethernet: cortina: Make RX SKB per-port

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmacrx is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device ...

CVE-2026-64038

CVE-2026-64038 concerns the Linux kernel hwmon lm90 driver. In lm90_probe(), devm actions to cancel alert_work and report_work were registered before hwmon device registration. With devm cleanup in reverse order, the hwmon device could be freed first, allowing lm90_update_alarms() to dereference ...

CVE-2026-63813 Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block"

In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: remove non-uptodate folio from the page cache in movedatablock" This reverts commit 9609dd704725a40cd63d915f2ab6c44248a44598. The kernel panics are keeping to be reported especially when the f2fs partition get almos...

kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat()

A flaw was found in the Linux kernel's procfs component. When reading /proc/pid/stat, the dotaskstat function accesses task-realparent without proper Read-Copy-Update RCU protection. This missing protection creates a race condition, which can lead to a Use-After-Free UAF vulnerability. A local...

The vulnerability of the `sco_sock_connect()` function in Linux operating system kernels, which allows a hacker to cause a service failure.

The vulnerability of the scosockconnect function in Linux operating systems is related to a race condition. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-46210

The CVE-2026-46210 issue affects the Linux kernel Iris media driver. A race between per-instance locks (inst->lock) and the core list lock (core->lock) allows a use-after-free during MBPF checks: MBPF iterates the core list and reads fields like fmt_src->width/height while iris_close() m...

CVE-2026-45918 ovpn: tcp - don't deref NULL sk_socket member after tcp_close()

In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - don't deref NULL sksocket member after tcpclose When deleting a peer in case of keepalive expiration, the peer is removed from the OpenVPN hashtable and is temporary inserted in a "release list" for further processing...

CVE-2026-45949

In the Linux kernel, the following vulnerability has been resolved: hwrng: core - use RCU and workstruct to fix race condition Currently, hwrngfill is not cleared until the hwrngfillfn thread exits. Since hwrngunregister reads hwrngfill outside the rngmutex lock, a concurrent hwrngunregister may...

Linux Distros Unpatched Vulnerability : CVE-2026-45916

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - power: supply: sbs-battery: Fix use-after-free in powersupplychanged Using the devm variant for requesting IRQ before the devm variant for allocating/registerin...

CVE-2026-24199

NVIDIA Display Driver for Linux contains a vulnerability in a kernel module, where a user could cause a race condition by reordering compiler or processor memory instructions. A successful exploit of this vulnerability might lead to denial of service...

CVE-2026-24199

NVIDIA Display Driver for Linux contains a vulnerability in a kernel module, where a user could cause a race condition by reordering compiler or processor memory instructions. A successful exploit of this vulnerability might lead to denial of service...

Astra Linux – Vulnerability in Linux, Linux 5.10

A memory flaw after deallocation was discovered in the Linux kernel’s garbage collection for Unix domain socket file handlers. This flaw occurs when users call close and fget simultaneously, potentially triggering a race condition. This flaw allows a local user to crash the system or escalate the...