CVE-2026-64418

CVE-2026-64418 is a Linux kernel memory-management race in the shrinker subsystem. The vulnerability arises when the shrinker_info array is freed while still accessible, causing use-after-free or double-free. The root cause is that alloc_shrinker_info() can drop shrinker_mutex before finishing in...

CVE-2026-64418 mm: shrinker: fix shrinker_info teardown race with expansion

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix shrinkerinfo teardown race with expansion expandshrinkerinfo iterates all visible memcgs under shrinkermutex, including memcgs that have not finished -cssonline yet. Once pn-shrinkerinfo has been published,...

EUVD-2026-48941

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERYDIRECTORY requests per file smb2querydir stores a pointer to its stack-allocated private data in the ksmbdfile readdirdata. Concurrent QUERYDIRECTORY requests using the same file handle can overwrite this...

CVE-2026-64397 ksmbd: serialize QUERY_DIRECTORY requests per file

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERYDIRECTORY requests per file smb2querydir stores a pointer to its stack-allocated private data in the ksmbdfile readdirdata. Concurrent QUERYDIRECTORY requests using the same file handle can overwrite this...

CVE-2026-64397

CVE-2026-64397 affects the Linux kernel ksmbd component. The issue arises in smb2_query_dir() which stores a pointer to stack-allocated private data in ksmbd_file readdir_data; concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while an iterate_dir() callbac...

CVE-2026-64397 ksmbd: serialize QUERY_DIRECTORY requests per file

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERYDIRECTORY requests per file smb2querydir stores a pointer to its stack-allocated private data in the ksmbdfile readdirdata. Concurrent QUERYDIRECTORY requests using the same file handle can overwrite this...

CVE-2026-64397

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERYDIRECTORY requests per file smb2querydir stores a pointer to its stack-allocated private data in the ksmbdfile readdirdata. Concurrent QUERYDIRECTORY requests using the same file handle can overwrite this...

CVE-2026-64344 USB: idmouse: fix use-after-free on disconnect race

In the Linux kernel, the following vulnerability has been resolved: USB: idmouse: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a...

CVE-2026-64344

CVE-2026-64344 is a use-after-free in the Linux kernel's USB idmouse driver triggered by a disconnect race. The root cause is that mutex_unlock() is non-atomic and may still access the mutex structure after release, making it unsafe for managing object lifetime. The fix replaces direct mutex-base...

EUVD-2026-48887

In the Linux kernel, the following vulnerability has been resolved: USB: ldusb: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a kr...

EUVD-2026-48885

In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use ...

CVE-2026-64341

A use-after-free in the Linux kernel's USB iowarrior driver is triggered by a race between release() and disconnect(). Because mutex_unlock() is non-atomic, it may access a freed mutex structure after driver data is deallocated during disconnect. The fix replaces mutex-based lifetime management w...

CVE-2026-64340 USB: legousbtower: fix use-after-free on disconnect race

In the Linux kernel, the following vulnerability has been resolved: USB: legousbtower: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 U...

CVE-2026-64340

CVE-2026-64340 is a use-after-free in the Linux kernel's USB legousbtower driver caused by a race between release() and disconnect(). The root cause is that mutex_unlock() can access the mutex structure after the lock is released, making it unsafe for object lifetime management. The fix introduce...

EUVD-2026-48884

In the Linux kernel, the following vulnerability has been resolved: USB: legousbtower: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 U...

CVE-2026-64300 perf/aux: Fix page UAF in map_range()

In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in maprange maprange reads rb-auxpages, rb-auxnrpages and rb-auxpgoff via perfmmaptopage while holding only event-mmapmutex. Those fields are serialized by rb-auxmutex, and mmapmutex is per event. Thus, two...

CVE-2026-64300

CVE-2026-64300 (Linux kernel, perf/aux): Concrete details across connected docs show a page-use-after-free (UAF) in map_range() due to reading rb->aux_pages[], rb->aux_nr_pages, and rb->aux_pgoff under the wrong mutex, enabling a race between rb_alloc_aux() and map_range() when PERF_EVEN...

EUVD-2026-49012

In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in maprange maprange reads rb-auxpages, rb-auxnrpages and rb-auxpgoff via perfmmaptopage while holding only event-mmapmutex. Those fields are serialized by rb-auxmutex, and mmapmutex is per event. Thus, two...

CVE-2026-64300 perf/aux: Fix page UAF in map_range()

In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in maprange maprange reads rb-auxpages, rb-auxnrpages and rb-auxpgoff via perfmmaptopage while holding only event-mmapmutex. Those fields are serialized by rb-auxmutex, and mmapmutex is per event. Thus, two...

Linux Distros Unpatched Vulnerability : CVE-2026-64300

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in maprange maprange reads rb-auxpages, rb-auxnrpages and rb-auxpgoff...