CVE-2026-74533

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs krefgetunlesszero hciconn::isodata is accessed and modified without lock or RCU. This leads to a race Task hdev-workqueue Task 2 isorecv isoconnputconn conn = LOAD hcon-isodata isoconnfreeconn...

CVE-2026-74533

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs krefgetunlesszero hciconn::isodata is accessed and modified without lock or RCU. This leads to a race Task hdev-workqueue Task 2 isorecv isoconnputconn conn = LOAD hcon-isodata isoconnfreeconn...

CVE-2026-72328

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdnaumap lifetime race amdxdnaumaprelease calls the blocking mmuintervalnotifierremove before removing the object from abo-mem.umaplist. If aie2populaterange runs concurrently, it may obtain a...

UBUNTU-CVE-2026-74405

In the Linux kernel, the following vulnerability has been resolved: OPP: Fix race between OPP addition and lookup A race exists between devpmoppadddynamic and devpmoppfindfreqexact: CPU0 add CPU1 lookup ------------------------------- ------------------------------ oppadd mutexlock...

UBUNTU-CVE-2026-72328

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdnaumap lifetime race amdxdnaumaprelease calls the blocking mmuintervalnotifierremove before removing the object from abo-mem.umaplist. If aie2populaterange runs concurrently, it may obtain a...

UBUNTU-CVE-2026-72469

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDRCHANGE rpcrdmacmeventhandler falls through to the disconnected: label on RDMACMEVENTADDRCHANGE and calls rpcrdmaepput with no matching get when the event arrives before RDMACMEVENTESTABLISHE...

CVE-2026-72469

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDRCHANGE rpcrdmacmeventhandler falls through to the disconnected: label on RDMACMEVENTADDRCHANGE and calls rpcrdmaepput with no matching get when the event arrives before RDMACMEVENTESTABLISHE...

UBUNTU-CVE-2026-72073

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: fix use-after-free on probe failure The vub300 driver lifetime-manages its controller state using vub300-kref, with vub300delete freeing the mmc host when the last reference is dropped. The probe error path after the...

CVE-2026-74405

The CVE-2026-74405 issue affects the Linux kernel OPP handling. A race between dev_pm_opp_add_dynamic() and dev_pm_opp_find_freq_exact() could expose a newly added OPP before its kref and opp_table were initialized, allowing a concurrent lookup to increment the reference count on an uninitialized...

EUVD-2026-59368

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDRCHANGE rpcrdmacmeventhandler falls through to the disconnected: label on RDMACMEVENTADDRCHANGE and calls rpcrdmaepput with no matching get when the event arrives before RDMACMEVENTESTABLISHE...

CVE-2026-72469 xprtrdma: Fix ep kref imbalance on ADDR_CHANGE

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDRCHANGE rpcrdmacmeventhandler falls through to the disconnected: label on RDMACMEVENTADDRCHANGE and calls rpcrdmaepput with no matching get when the event arrives before RDMACMEVENTESTABLISHE...

CVE-2026-72328 accel/amdxdna: Fix potential amdxdna_umap lifetime race

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdnaumap lifetime race amdxdnaumaprelease calls the blocking mmuintervalnotifierremove before removing the object from abo-mem.umaplist. If aie2populaterange runs concurrently, it may obtain a...

CVE-2026-72328 accel/amdxdna: Fix potential amdxdna_umap lifetime race

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdnaumap lifetime race amdxdnaumaprelease calls the blocking mmuintervalnotifierremove before removing the object from abo-mem.umaplist. If aie2populaterange runs concurrently, it may obtain a...

CVE-2026-72082 scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix refcount leak in efcthwioabort When efcthwreqtagalloc fails in efcthwioabort, the error path returns -ENOSPC without releasing the reference obtained via krefgetunlesszero earlier in the function. All other...

CVE-2026-72073 mmc: vub300: fix use-after-free on probe failure

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: fix use-after-free on probe failure The vub300 driver lifetime-manages its controller state using vub300-kref, with vub300delete freeing the mmc host when the last reference is dropped. The probe error path after the...

CVE-2026-72073 mmc: vub300: fix use-after-free on probe failure

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: fix use-after-free on probe failure The vub300 driver lifetime-manages its controller state using vub300-kref, with vub300delete freeing the mmc host when the last reference is dropped. The probe error path after the...

CVE-2026-72040

In the Linux kernel IPMI subsystem, CVE-2026-72040 is a refcount leak in i_ipmi_request() when a caller provides a supplied_recv message. If an error occurs, the out_err path skips freeing the recv_msg and leaves the user’s nr_msgs refcount elevated. The fix reverts the reference count operations...

CVE-2026-72040 ipmi: fix refcount leak in i_ipmi_request()

In the Linux kernel, the following vulnerability has been resolved: ipmi: fix refcount leak in iipmirequest When a caller provides a suppliedrecv message to iipmirequest, the function increments the user's nrmsgs reference count. If an error occurs later, the outerr cleanup path only frees the...

PT-2026-72271

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix refcount leak in efct hw io abort When efct hw reqtag alloc fails in efct hw io abort, the error path returns -ENOSPC without releasing the reference obtained via kref get unless zero earlier in the function...

PT-2026-72516

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdna umap lifetime race amdxdna umap release calls the blocking mmu interval notifier remove before removing the object from abo-mem.umap list. If aie2 populate range runs concurrently, it may obta...