CVE-2026-64416 mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host

In the Linux kernel, the following vulnerability has been resolved: mm: swapcgroup: fix NULL deref in lookupswapcgroupid on swapless host lookupswapcgroupid passes swapcgroupctrltype.map to swapcgroupidlookup without checking that the type was ever registered via swapcgroupswapon. On a swapless...

CVE-2026-64413

CVE-2026-64413 relates to the Linux kernel netfilter/ebtables path, specifically the zero chainstack array issue. The advisory describes that if cpu_possible_mask is sparse (e.g., CPU 0 and CPU 2 possible, CPU 1 not), the allocation loop can skip an entry and, if vmalloc_node() fails later, the c...

CVE-2026-64408 Bluetooth: bnep: pin L2CAP connection during netdev registration

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnepaddconnection reads the L2CAP connection without holding the channel lock, then passes its HCI device to registernetdev. Controller teardown can clear and relea...

CVE-2026-64405 Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix null ptr deref in hciabortconn hciabortconn read hciskbeventhdev-sentcmd when a connection was pending, but hdev-sentcmd can be NULL while reqstatus is still HCIREQPEND, leading to a NULL pointer dereferen...

EUVD-2026-48949

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix null ptr deref in hciabortconn hciabortconn read hciskbeventhdev-sentcmd when a connection was pending, but hdev-sentcmd can be NULL while reqstatus is still HCIREQPEND, leading to a NULL pointer dereferen...

CVE-2026-64405 Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix null ptr deref in hciabortconn hciabortconn read hciskbeventhdev-sentcmd when a connection was pending, but hdev-sentcmd can be NULL while reqstatus is still HCIREQPEND, leading to a NULL pointer dereferen...

CVE-2026-64405

CVE-2026-64405 affects the Linux kernel Bluetooth subsystem (HCI). The vulnerability arises when hci_abort_conn() reads hdev->sent_cmd during a pending connection, where sent_cmd can be NULL (req_status == HCI_REQ_PEND), causing a NULL pointer dereference. The fix introduces a per-connection H...

CVE-2026-64405

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix null ptr deref in hciabortconn hciabortconn read hciskbeventhdev-sentcmd when a connection was pending, but hdev-sentcmd can be NULL while reqstatus is still HCIREQPEND, leading to a NULL pointer dereferen...

EUVD-2026-48869

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/ When a channel-switch...

CVE-2026-64325

In the Linux kernel wifi mt76 driver (mt7921/mt7925), CVE-2026-64325 describes a NULL pointer dereference triggered when a CSA beacon is processed and the station disconnects before the queued work runs. The issue arises from dereferencing dev->new_ctx without a NULL check in mt7921_channel_sw...

CVE-2026-64325 wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/ When a channel-switch...

CVE-2026-64314

The CVE-2026-64314 entry refers to a Linux kernel vulnerability in the crypto/chacha20poly1305 module. The issue arises in chachapoly_create() which may pass a missing poly1305 template argument to a following strcmp() because it does not validate the second template argument. crypto_attr_alg_nam...

CVE-2026-64314 crypto: chacha20poly1305 - validate poly1305 template argument

In the Linux kernel, the following vulnerability has been resolved: crypto: chacha20poly1305 - validate poly1305 template argument chachapolycreate still accepts the compatibility poly1305 parameter in the template name, but it assumes the second template argument is always present and immediatel...

EUVD-2026-49009

In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of moduleextendmaxpages moduleextendmaxpages calls kvrealloc internally and returns -ENOMEM on allocation failure. The return value is never checked. If the initial allocation fails,...

CVE-2026-64297 module: decompress: check return value of module_extend_max_pages()

In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of moduleextendmaxpages moduleextendmaxpages calls kvrealloc internally and returns -ENOMEM on allocation failure. The return value is never checked. If the initial allocation fails,...

CVE-2026-64297

CVE-2026-64297 concerns a Linux kernel module path in which module_extend_max_pages() calls kvrealloc() and returns -ENOMEM on failure, but the return value is never checked. If the initial allocation fails, info->pages is NULL and info->max_pages is 0; later calls to module_get_next_page()...

EUVD-2026-49000

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcpu not being onlined yet no pseudo-TLB allocated. Similarly, the TLB...

CVE-2026-64288

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcpu not being onlined yet no pseudo-TLB allocated. Similarly, the TLB...

EUVD-2026-48970

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

SUSE CVE-2026-64215

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xxhfisendperftable Check the return value of kzalloc to prevent a NULL pointer dereference on allocation failure. Patchwork: https://patchwork.freedesktop.org/patch/721342/...