Linux Distros Unpatched Vulnerability : CVE-2026-74466

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus th...

Linux Distros Unpatched Vulnerability : CVE-2026-72334

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject...

Linux Distros Unpatched Vulnerability : CVE-2026-74472

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ublk: reset kernel-owned devinfo fields in ublkctrladddev ublkctrladddev memcpys the userspace ublksrvctrldevinfo into ub-devinfo and then fixes up the fields t...

PT-2026-73003

In the Linux kernel, the following vulnerability has been resolved: hwmon: nzxt-smart2 DMA-align output buffer Sashiko reports: When send output report calls hid hw output report, the underlying USB HID core calls usb interrupt msg which maps this buffer directly for DMA. When the DMA mapping...

PT-2026-72988

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release iso sock kill tests !sock flagsk, SOCK ZAPPED || sk-sk socket || sock flagsk, SOCK DEAD for early return, but this is always true since sock orphansk sets SOCK DEAD, so the sk...

PT-2026-72943

In the Linux kernel, the following vulnerability has been resolved: of/address: Fix NULL bus dereference in of pci range parser one The bus matching rework made of match bus return NULL for nodes with ranges/dma-ranges but no local address-cells. parser init stored that NULL bus, and the range...

PT-2026-72971

In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: don't free uninitialized dev name on error path dt remember or free map duplicates dev name for each map entry. If kstrdup const fails, dt free map frees dev name in all num maps entries, including entries th...

PT-2026-72369

In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASK OFFSTACK memory corruption This patch addresses a critical memory management flaw. When CONFIG CPUMASK OFFSTACK is enabled, cpumask var t is a pointer. Consequently, sizeofnew mask evaluates to the pointe...

PT-2026-72493

In the Linux kernel, the following vulnerability has been resolved: VDUSE: avoid leaking information to userspace The bounceing is not necessarily page aligned, so current VDUSE can leak kernel information through mapping bounce pages to userspace. Allocate bounce pages with GFP ZERO to avoid...

PT-2026-72494

In the Linux kernel, the following vulnerability has been resolved: vduse: Fix race in vduse dev msg sync and vduse dev read iter There is one race case in vduse dev msg sync and vduse dev read iter: vduse dev read iter: lockmsg lock; dequeue msgsend list; unlockmsg lock; vduse dev msg sync: wait...

PT-2026-72333

In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/tpmi: use cleanup helpers in mem write In mem write, the temporary array returned by parse int array user must be released on all exit paths. Convert the array variable to use cleanup.h scope-based cleanup so i...

PT-2026-72438

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack reasm: guard mac header adjustment after IPv6 defrag nf ct frag6 reasm slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb-mac header: skb-mac header +=...

PT-2026-72451

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: fix memory leak in snd sof load topology When the topology filename contains "dummy" and tplg cnt is 0, the function returns -EINVAL directly without freeing the tplg files allocated by kcalloc at line 2497...

PT-2026-72364

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: put stats for scheme add dirs internal error damon sysfs scheme add dirs setup the tried regions directory after the stats directory setup is completed. When the tried regions directory setup is failed, th...

PT-2026-72325

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to July 2026 Description A double free issue exists in the xfrm component of the Linux kernel. The nat keepalive send function frees the keepalive skb socket buffer whenever the IPv4 or IPv6 send helper reports an...

PT-2026-72732

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Free the UAR index returned by the hardware...

PT-2026-72308

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcm tx lock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there, mirroring the approach already used in bcm rx setup. Only copy the...

PT-2026-72527

In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on build skb failure qede rx build skb and qede tpa rx build skb do not check for a NULL return from qede build skb. When it returns NULL under memory pressure, the functions still...

PT-2026-72978

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix potential deadlock in mpi3mr fault uevent emit mpi3mr fault uevent emit runs from the fault watchdog and reset paths where host I/O may already be blocked. GFP KERNEL allocations here, both the local kzalloc obj...

PT-2026-72916

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix skb leak on flow key update failure during ct ovs ct execute always steals or frees the skb on failure while ovs flow key update does not. So, if it fails and we return right away, the skb ends up leaked. Fi...