PT-2026-72677

In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvec rx completed In nvec rx completed, when an incomplete RX transfer is detected, nvec msg free is called to return the message back to the pool by clearing its 'used' atomic flag. Immediate...

PT-2026-72529

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix publication race for priv-channel stats mlx5e channel stats alloc publishes a new entry to priv-channel stats and then increments priv-stats nch as a publication token, but neither store carries any memory barrier:...

PT-2026-72308

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcm tx lock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there, mirroring the approach already used in bcm rx setup. Only copy the...

PT-2026-72418

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: free unfragmentable packet The caller of batadv frag send packet assume that the skb provided to the function are always consumed. But the pre-check for an empty payload or the zero fragment size returned an err...

PT-2026-72326

In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: fix error handling in ioctl When gntdev ioctl map grant ref fails to copy the operation result back to userspace after successfully adding the mapping to the list, the error path returns -EFAULT without releasing the...

PT-2026-72715

In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sg cleanup error path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

PT-2026-72916

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix skb leak on flow key update failure during ct ovs ct execute always steals or frees the skb on failure while ovs flow key update does not. So, if it fails and we return right away, the skb ends up leaked. Fi...

PT-2026-72815

In the Linux kernel, the following vulnerability has been resolved: dax/kmem: account for partial discontiguous resource upon removal When dev dax kmem probe partially succeeds at least one range is mapped but a subsequent range fails request mem region or add memory driver managed, the probe...

PT-2026-72203

In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recv dless read receives a P DATA REPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int data size,...

PT-2026-72717

In the Linux kernel, the following vulnerability has been resolved: tipc: reject inverted service ranges from peer bindings tipc update nametbl inserts a binding advertised by a peer node using the lower and upper service-range bounds taken directly from the wire, without checking that lower uppe...

PT-2026-73003

In the Linux kernel, the following vulnerability has been resolved: hwmon: nzxt-smart2 DMA-align output buffer Sashiko reports: When send output report calls hid hw output report, the underlying USB HID core calls usb interrupt msg which maps this buffer directly for DMA. When the DMA mapping...

PT-2026-72943

In the Linux kernel, the following vulnerability has been resolved: of/address: Fix NULL bus dereference in of pci range parser one The bus matching rework made of match bus return NULL for nodes with ranges/dma-ranges but no local address-cells. parser init stored that NULL bus, and the range...

PT-2026-72369

In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASK OFFSTACK memory corruption This patch addresses a critical memory management flaw. When CONFIG CPUMASK OFFSTACK is enabled, cpumask var t is a pointer. Consequently, sizeofnew mask evaluates to the pointe...

PT-2026-72499

In the Linux kernel, the following vulnerability has been resolved: drm/xe: free madvise VMA array on L2 flush failure xe vm madvise ioctl allocates madvise range.vmas in get vmas. After get vmas succeeds with at least one VMA, error paths must go through free vmas so the array is released before...

Linux Distros Unpatched Vulnerability : CVE-2026-72321

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: igmp: Fix potential memory leaks in igmpmodtimer and igmpstoptimer When a timer is deleted and not re-armed in igmpmodtimer, or stopped in igmpstoptimer,...

PT-2026-72451

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: fix memory leak in snd sof load topology When the topology filename contains "dummy" and tplg cnt is 0, the function returns -EINVAL directly without freeing the tplg files allocated by kcalloc at line 2497...

Linux Distros Unpatched Vulnerability : CVE-2026-74558

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xsk: reclaim invalid Tx descriptors in ZC batch path The zero-copy Tx batch parser stops when it encounters an invalid descriptor. If this happens after one or...

Linux Distros Unpatched Vulnerability : CVE-2026-74551

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: nzxt-smart2 DMA-align output buffer Sashiko reports: When sendoutputreport calls hidhwoutputreport, the underlying USB HID core calls usbinterruptmsg whi...

Linux Distros Unpatched Vulnerability : CVE-2026-72017

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: macb: drop in-flight Tx SKBs on close The MACB driver has since forever leaked the outgoing SKBs that have not yet been marked as completed. They live in...

Linux Distros Unpatched Vulnerability : CVE-2026-74456

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: peakusb: peakusbstart: fix double free of transfer buffer on URB submit error In peakusbstart, each RX URB transfer buffer is allocated with kmalloc and t...