CVE-2026-64509 rust: block: fix GenDisk cleanup paths

In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build still has fallible work after blkmqallocdisk, but its error path only recovers the foreign queue data. That leaks the temporary gendisk and requestqueue until later...

CVE-2026-64500

In the Linux kernel, the following vulnerability has been resolved: iio: adc: lpc32xx: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "lpc32xxadcprobe in drivers/iio/adc/lpc32xxadc.c registers its interrupt handler with devmrequestirq before it initializes...

CVE-2026-64453

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbiodisconnect walks usbio-clilist in reverse and uninitializes each auxiliary device. auxiliarydeviceuninit drops the device reference, and for an unbound child that can r...

CVE-2026-64452 6lowpan: fix NHC entry use-after-free on error path

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

CVE-2026-64452

CVE-2026-64452 (Linux kernel 6LoWPAN) involves a race condition in 6LoWPAN’s Next Header Compression (NHC) handling that can cause a use-after-free in lowpan_nhc_do_uncompression when an NHC descriptor is freed while another path accesses nhc->name in an error path. The issue arises from holdi...

CVE-2026-64421 media: nxp: imx8-isi: Fix use-after-free on remove

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix use-after-free on remove KASAN reports a slab-use-after-free in mediaentityremovelink during rmmod of imx8isi: BUG: KASAN: slab-use-after-free in mediaentityremovelink+0x608/0x650 Read of size 2 at addr...

CVE-2026-64421 media: nxp: imx8-isi: Fix use-after-free on remove

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix use-after-free on remove KASAN reports a slab-use-after-free in mediaentityremovelink during rmmod of imx8isi: BUG: KASAN: slab-use-after-free in mediaentityremovelink+0x608/0x650 Read of size 2 at addr...

CVE-2026-64421

CVE-2026-64421 is a use-after-free in the Linux kernel's imx8_isi driver (NXP i.MX8 Image Sensor Interface). During module removal (rmmod), mxc_isi_remove() called mxc_isi_crossbar_cleanup() before mxc_isi_v4l2_cleanup(), freeing media entity pads while the subsequent V4L2 cleanup still attempted...

CVE-2026-64418 mm: shrinker: fix shrinker_info teardown race with expansion

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix shrinkerinfo teardown race with expansion expandshrinkerinfo iterates all visible memcgs under shrinkermutex, including memcgs that have not finished -cssonline yet. Once pn-shrinkerinfo has been published,...

EUVD-2026-48940

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct filelock in SMB2LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred in the FILELOCKDEFERRED path, ksmbd registers the asynchronous work into the connection's asyncrequests...

CVE-2026-64381

CVE-2026-64381 is a memory leak in the Linux kernel SMB client (CIFS), specifically in receive_encrypted_standard(). The function allocates next_buffer before checking whether the number of compound PDUs has reached MAX_COMPOUND. When that check fails, the function returns immediately without ass...

EUVD-2026-48876

In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is never freed on early ULPI device registration failures. Fix this by initialising the device structure earlier and releasing the initial reference...

CVE-2026-64329

A use-after-free race condition exists in the Linux kernel's USB Type-C UCSI CCG driver. In the device remove path (ucsi_ccg_remove()), ucsi_destroy() frees the ucsi object before free_irq() is called, so an in-flight threaded IRQ handler may dereference the freed memory. The fix reorders free_ir...

CVE-2026-64279 i2c: core: fix adapter deregistration race

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter deregistration race Adapters can be looked up by their id using i2cgetadapter which takes a reference to the embedded struct device. Remove the adapter from the IDR before tearing it down during...

PT-2026-64550

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the USB Type-C UCSI CCG driver. The threaded IRQ handler ccg irq handler invokes ucsi notify common, which may trigger ucsi connector change and schedule...

Traceable LLM Reasoning for Fake-Order Fraud Detection

Detecting fake-order fraud at scale remains a critical challenge for large online-to-offline O2O service platforms, as existing approaches often rely on expert-designed features, produce black-box decisions, and provide limited interpretability. To address these limitations, we propose DeepScrub,...

CVE-2026-64401: Use After Free

In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifsswnnotify looks up a witness registration by id under cifsswnregidrmutex, drops the mutex, and then uses the registration's cached tcon pointer. That pointer is not a...

PT-2026-64721

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the lpc32xx adc probe function within the drivers/iio/adc/lpc32xx adc.c file. The function registers an interrupt handler using devm request irq before initializing th...

PT-2026-64674

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free UAF issue exists in the usbio disconnect function during client teardown. The function iterates through the usbio-cli list in reverse to uninitialize auxiliary devices...

PT-2026-64622

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the SMB client. The cifs swn notify function retrieves a witness registration by ID using the cifs swnreg idr mutex mutex, releases the mutex, and...