CVE-2026-74448

A flaw was found in the Linux kernel's drm/amdkfd component. When a process attempts to create its first queue, a failure in memory allocation can cause the pqmcreatequeue function to exit prematurely without releasing a reserved Queue ID QID bit. This leads to a permanent leak of QID slots. Over...

CVE-2026-72068

A flaw was found in the Linux kernel's posix-cpu-timers component on 32-bit systems. An integer truncation vulnerability occurs in the updaterlimitcpu function when converting the RLIMITCPU value to nanoseconds. This issue causes the process CPU timer to be programmed to fire prematurely for...

CVE-2026-72396

A flaw was found in the Linux kernel's hwmon subsystem, specifically in the adm1275 driver. This vulnerability allows a local attacker or a specially crafted device to trigger an out-of-bounds read during device name comparison. By providing a device name shorter than expected, uninitialized stac...

CVE-2026-72403

A flaw was found in the ALSA FireWire Control Protocol FCP component of the Linux kernel. A local attacker with a specially crafted USB device could trigger a NULL pointer dereference. This occurs because the fcpfindfcinterface function attempts to access an endpoint descriptor from a malformed U...

CVE-2026-72245

A flaw was found in the Linux kernel's gpu: host1x subsystem. An error handling path in the host1xdeviceparsedt function, when called from host1xdeviceadd, fails to properly release a device reference. This oversight leads to a device reference leak, which could potentially result in resource...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 Android arm64 Local Privilege Escalation Adapta...

kernel: dm log: fix out-of-bounds write due to region_count overflow

A flaw was found in the Linux kernel's device-mapper log dm log component. A local attacker could exploit an integer overflow vulnerability where a 64-bit value is truncated to 32 bits, leading to undersized memory allocations. This allows for out-of-bounds writes to kernel memory during log...

kernel: net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

A flaw was found in the Linux kernel's Asynchronous Transfer Mode ATM networking component. A local attacker, by acting as a malicious signaling daemon, could send a specially crafted message containing an unvalidated pointer. This unvalidated pointer would be directly used by the kernel, leading...

kernel: scsi: core: Wake up the error handler when final completions race against each other

Race condition vulnerabilities were found in the Linux kernel's SCSI error handler wake-up logic. Memory ordering issues in scsidechostbusy and ordering problems in scsiehinchostfailed can cause the SCSI error handler to never wake up when command completions race against each other. This leaves...

kernel: crypto: ccp - copy IV using skcipher ivsize

A flaw was found in the Linux kernel's cryptographic coprocessor CCP driver. When processing AFALG rfc3686-ctr-aes-ccp requests, the ccpaescomplete function attempts to restore more data than the allocated buffer for the Initialization Vector IV can hold. This leads to a buffer overrun, which can...

kernel: net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

A flaw was found in the Linux kernel's Asynchronous Transfer Mode ATM networking component. A local attacker, by acting as a malicious signaling daemon, could send a specially crafted message containing an unvalidated pointer. This unvalidated pointer would be directly used by the kernel, leading...

kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

A flaw was found in the Linux kernel's CIFS Common Internet File System client. When the cifssanitizeprepath function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-boun...

UBUNTU-CVE-2026-74955

Privilege escalation in the Request Handling component. This vulnerabi...

Linux Distros Unpatched Vulnerability : CVE-2026-74326

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix resource leak in probe error path When pcimiomapregion or devmkmemdu...

Oracle Linux 10 : kernel (ELSA-2026-38492)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-38492 advisory. - crypto: ccp - copy IV using skcipher ivsize CKI Backport Bot RHEL-188463 CVE-2026-53016 - futex/requeue: Revert 'Prevent NULL pointer dereference i...

CVE-2026-72339

A flaw was found in the Linux kernel's qede component, which handles network device operations. Under specific memory pressure conditions, an error in how network buffer descriptors BDs are managed can lead to an off-by-one issue. This desynchronizes the BD ring, potentially corrupting memory and...

CVE-2026-72338

A flaw was found in the Linux kernel's net/sched: actpedit component. A Time-of-check to time-of-use TOCTOU race condition exists when sizing and filling a flowrule buffer. This vulnerability allows a local attacker with CAPNETADMIN capabilities to perform a heap out-of-bounds write with controll...

CVE-2026-72337

A flaw was found in the Linux kernel's Bluetooth 6LoWPAN IPv6 over Low-Power Wireless Personal Area Networks component. This vulnerability occurs due to a race condition during the module's exit process, where a scheduled task attempts to access memory that has already been released. A local...

CVE-2026-72336

A flaw was found in the Linux kernel's Bluetooth 6LoWPAN IPv6 over Low-Power Wireless Personal Area Networks component. A race condition exists where an L2CAP Logical Link Control and Adaptation Protocol connection is accessed after its protection is dropped, allowing it to be deallocated...

CVE-2026-72335

A flaw was found in the Linux kernel's Bluetooth Management MGMT component. A use-after-free vulnerability exists in the advertisement monitor add failure cleanup process. This occurs because an advertisement monitor object is prematurely freed while a subsequent management routine attempts to...