The vulnerability of the `fst_remove_one()` function in the `drivers/net/wan/farsync.c` file of the Linux kernel network device driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fstremoveone function in the drivers/net/wan/farsync.c file of the Linux kernel network device driver is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...

TencentOS Server 4: kernel (TSSA-2026:0792)

"The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0792 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilitie...

RockyLinux 9 : kernel (RLSA-2026:49870)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:49870 advisory. kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown CVE-2025-68214 Bug Fixes and Enhancements: Possible regression with...

CVE-2026-64582

The CVE concerns a race in the Linux kernel RDMA/rxe path, specifically in rxe_mmap. A use-after-free can occur when rxe_mmap_info is removed from pending_mmaps while its kref is not yet released, due to a concurrent DESTROY_CQ ioctl. The race between vmalloc range remapping and freeing vmalloc-e...

CVE-2026-64582 RDMA/rxe: Fix a use-after-free problem in rxe_mmap

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxemmap rxemmap removes a rxemmapinfo struct from the pendingmmaps list and releases pendinglock while the struct's kref is still at 1: listdelinit&ip-pendingmmaps;...

UBUNTU-CVE-2026-64578

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound chained SMB2 request, ksmbdsmb2checkmessage reads pdu-StructureSize2 without first checking that the compound element is large...

UBUNTU-CVE-2026-64566

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate SKBFLSHAREDFRAG in iptfsskbaddfrags When iptfsskbaddfrags copies frag references from the source frag walk into a new SKB, it increments the page reference count via skbfragref but does not propagate...

EUVD-2026-53272

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound chained SMB2 request, ksmbdsmb2checkmessage reads pdu-StructureSize2 without first checking that the compound element is large...

CVE-2026-64576 nexthop: initialize extack in nh_res_bucket_migrate()

In the Linux kernel, the following vulnerability has been resolved: nexthop: initialize extack in nhresbucketmigrate nhresbucketmigrate passes an uninitialized netlinkextack to callnexthopresbucketnotifiers. When nhnotifierresbucketinfoinit fails e.g. the kzalloc returns -ENOMEM, the error is...

CVE-2026-64571 wifi: p54: validate RX frame length in p54_rx_eeprom_readback()

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54rxeepromreadback p54rxeepromreadback copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit...

CVE-2026-64567 btrfs: reject free space cache with more entries than pages

In the Linux kernel, the following vulnerability has been resolved: btrfs: reject free space cache with more entries than pages When loading a v1 free space cache, loadfreespacecache takes numentries and numbitmaps straight from the on-disk btrfsfreespaceheader. That header is stored in the...

CVE-2026-64567 btrfs: reject free space cache with more entries than pages

In the Linux kernel, the following vulnerability has been resolved: btrfs: reject free space cache with more entries than pages When loading a v1 free space cache, loadfreespacecache takes numentries and numbitmaps straight from the on-disk btrfsfreespaceheader. That header is stored in the...

CVE-2026-64567

The CVE-2026-64567 vulnerability affects the Linux kernel’s btrfs free-space-cache loading. The issue stems from loading a v1 free-space cache where num_entries can exceed the available pages, allowing io_ctl_check_crc to advance past the end of the pages[] array. This leads to a slab-out-of-boun...

CVE-2026-64566 xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate SKBFLSHAREDFRAG in iptfsskbaddfrags When iptfsskbaddfrags copies frag references from the source frag walk into a new SKB, it increments the page reference count via skbfragref but does not propagate...

ROS-20260805-73-0017

The vulnerability in the kernel-lt is related to the swapping of the zero pointer. Exploiting this vulnerability can allow an attacker to cause a service failure...

MiracleLinux 8 : kernel-4.18.0-553.148.1.el8_10 (AXSA:2026-1465:59)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1465:59 advisory. kernel: ipv6: fix possible UAF in icmpv6rcv CVE-2026-53006 Tenable has extracted the preceding description block directly from the MiracleLinux security...

ROS-20260805-73-0018

The vulnerability in the kernel-lt is related to the lack of memory release after the effective lifespan has ended. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260805-73-0013

The vulnerability of the imxdsprproc function in the Linux operating system is related to errors during resource release. Exploiting this vulnerability can allow an attacker to cause a service failure...

Exploit for Use After Free in Linux Linux_Kernel

No d...

CVE-2026-64564

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctpprocessasconf caches the transport the ASCONF chunk is processed against in asconf-transport == chunk-transport, set once in sctprcv. For an ASCONF located...