CVE-2026-64079

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: allocate hook ops while under mutex arp/ip6tregistertable add the table to the per-netns list via xtregistertable before allocating the per-netns hook ops copy via kmemduparray. This leaves a window where the...

CVE-2026-64048

The CVE-2026-64048 issue is in the Linux kernel SMC-D client (net/smc). A remote peer can reply with CHID 0 to a SMC-Dv2 proposal, matching an empty ism_dev slot and causing ini->ism_selected to 0. This can lead to a NULL pointer dereference in smc_conn_create() when dereferencing ism_dev[0]-&...

CVE-2026-64048 net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot

In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ismdev slot On the SMC-D client, slot 0 of ini-ismdev/ini-ismchid is reserved for an SMC-Dv1 device. smcfindismv2deviceclnt populates V2 entries starting at index 1, so when no ...

CVE-2026-64028

In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from histfieldname on truncation histfieldname returns "" everywhere except the fully-qualified VARREF/EXPR case, where snprintf truncation returns NULL early and bypasses the bottom NULL-"" guard...

CVE-2026-64004

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix locking in .getsockopt Mirror iucvsocksetsockopt and wrap the whole switch in locksock/releasesock. The pre-existing SOMSGLIMIT-only lock becomes redundant and is removed. Any AFIUCV HIPER user can potentially crash...

CVE-2026-63973

In the Linux kernel, the following vulnerability has been resolved: net: mana: Add NULL guards in teardown path to prevent panic on attach failure When queue allocation fails partway through, the error cleanup frees and NULLs apc-txqp and apc-rxqs. Multiple teardown paths such as manaremove,...

EUVD-2026-45745

In the Linux kernel, the following vulnerability has been resolved: net: mana: Skip redundant detach on already-detached port When manaperportqueueresetworkhandler runs after a previous detach succeeded but attach failed, the port is left in a detached state with apc-txqp and apc-rxqs already...

CVE-2026-63945 Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

CVE-2026-63945

CVE-2026-63945 affects the Linux kernel Bluetooth ISO code. The vulnerability arises when iso_sock_clear_timer() reads iso_pi(sk)->conn twice without holding the socket lock, while iso_chan_del() may NULL the connection under lock_sock, creating a window where the reference can be dropped and ...

CVE-2026-63945

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

CVE-2026-53391

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length raddr in nfs4decodempdsaddr nfs4decodempdsaddr decodes the rnetid and raddr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately calls strrchrbuf, '.' to locate the port...

CVE-2026-53400

CVE-2026-53400 pertains to the Linux kernel: i2c core adapter registration race. The issue arises when looking up adapters by id via i2c_get_adapter(), which uses a reference to an embedded struct device. The advisory states that the adapter (including its struct device) must be initialised befor...

CVE-2026-53400

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2cgetadapter which takes a reference to the embedded struct device. Make sure that the adapter including its struct device has been...

CVE-2026-53400

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2cgetadapter which takes a reference to the embedded struct device. Make sure that the adapter including its struct device has been...

CVE-2026-53400 i2c: core: fix adapter registration race

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2cgetadapter which takes a reference to the embedded struct device. Make sure that the adapter including its struct device has been...

CVE-2026-53391

CVE-2026-53391 affects the Linux kernel NFSv4/pNFS code. The nfs4_decode_mp_ds_addr decoder can dereference NULL when an on-wire r_addr opaque has zero length, because xdr_stream_decode_string_dup() may yield NULL and the code then calls strrchr(NULL, '.') leading to a kernel NULL pointer derefer...

EUVD-2026-45505

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...

CVE-2026-53383

The CVE-2026-53383 issue affects the Linux kernel’s ksmbd component where a COMPOUND request could bypass validation of the session state. Specifically, smb2_check_user_session() reused work->sess for operations beyond the first in a COMPOUND, validating only SessionId and not rechecking work-...

CVE-2026-53383 ksmbd: reject non-VALID session in compound request branch

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...

PT-2026-61416

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the drm/v3d component. In the CPU job ioctl error path, the system calls kvfree on timestamp and performance query arrays after v3d job cleanup has alrea...