UBUNTU-CVE-2026-74715

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...

UBUNTU-CVE-2026-74615

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlanchangelink arms vxlan-agetimer whenever the requested ageing interval differs from the configured one: if conf.ageinterval != vxlan-cfg.ageinterval...

CVE-2026-74670

In the Linux kernel, the following vulnerability has been resolved: ipvs: stop estimator after disabled calc phase IPVS estimator kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If network namespace teardown clears ipvs-enable during that phase,...

CVE-2026-74718 devlink: fix net namespace reference leak in reload

In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlinknlreloaddoit calls devlinknetnsget, which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not...

EUVD-2026-64405

In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlinknlreloaddoit calls devlinknetnsget, which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not...

CVE-2026-74718 devlink: fix net namespace reference leak in reload

In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlinknlreloaddoit calls devlinknetnsget, which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not...

CVE-2026-74718

This vulnerability affects the Linux kernel devlink subsystem. In devlink_nl_reload_doit(), a call to devlink_netns_get() acquires a reference to a network namespace. When the requested namespace differs from the current one and the reload action is not DRIVER_REINIT, the function returns -EOPNOT...

EUVD-2026-64402

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...

CVE-2026-74715

CVE-2026-74715 is a race condition in the Linux kernel BPF conntrack kfuncs (__bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry()). The opts argument can reference a shared BPF map value, and opts->netns_id is read independently during namespace reference acquisition and release. A concurrent wr...

EUVD-2026-64357

In the Linux kernel, the following vulnerability has been resolved: ipvs: stop estimator after disabled calc phase IPVS estimator kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If network namespace teardown clears ipvs-enable during that phase,...

CVE-2026-74670 ipvs: stop estimator after disabled calc phase

In the Linux kernel, the following vulnerability has been resolved: ipvs: stop estimator after disabled calc phase IPVS estimator kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If network namespace teardown clears ipvs-enable during that phase,...

CVE-2026-74670 ipvs: stop estimator after disabled calc phase

In the Linux kernel, the following vulnerability has been resolved: ipvs: stop estimator after disabled calc phase IPVS estimator kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If network namespace teardown clears ipvs-enable during that phase,...

CVE-2026-74670

CVE-2026-74670 affects the Linux kernel IPVS (IP Virtual Server) estimator subsystem. The IPVS estimator kthread starts with zeroed chain and tick limits until its initial calculation phase completes. If a network namespace teardown clears ipvs->enable during that phase, ip_vs_est_calc_phase()...

CVE-2026-74619

This Linux kernel vulnerability affects the overlayfs component. An unprivileged task can trigger a WARN_ON() in ovl_fill_super() by creating a user and mount namespace in a child process, calling fsopen("overlay"), passing the fscontext file descriptor to the parent, and having the parent issue ...

CVE-2026-74619 ovl: don't warn when the mount is completed from another user namespace

In the Linux kernel, the following vulnerability has been resolved: ovl: don't warn when the mount is completed from another user namespace fsopen records the caller's user namespace in fc-userns and hands back an ordinary file descriptor. Nothing ties the task that calls fsconfigFSCONFIGCMDCREAT...

CVE-2026-74619 ovl: don't warn when the mount is completed from another user namespace

In the Linux kernel, the following vulnerability has been resolved: ovl: don't warn when the mount is completed from another user namespace fsopen records the caller's user namespace in fc-userns and hands back an ordinary file descriptor. Nothing ties the task that calls fsconfigFSCONFIGCMDCREAT...

EUVD-2026-64556

In the Linux kernel, the following vulnerability has been resolved: ovl: don't warn when the mount is completed from another user namespace fsopen records the caller's user namespace in fc-userns and hands back an ordinary file descriptor. Nothing ties the task that calls fsconfigFSCONFIGCMDCREAT...

CVE-2026-74618

CVE-2026-74618 affects the Linux kernel 's binfmt_misc filesystem. The root cause is a WARN_ON() in bm_fill_super() that triggers when a binfmt_misc mount is completed from a different user namespace than the one that created the fscontext via fsopen(). Because fsconfig(FSCONFIG_CMD_CREATE) autho...

EUVD-2026-64555

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't warn when the mount is completed from another user namespace fsopen records the caller's user namespace in fc-userns and hands back an ordinary file descriptor. Nothing ties the task that calls...

CVE-2026-74618 binfmt_misc: don't warn when the mount is completed from another user namespace

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't warn when the mount is completed from another user namespace fsopen records the caller's user namespace in fc-userns and hands back an ordinary file descriptor. Nothing ties the task that calls...