CVE-2026-49415

FreeBSD kernel is affected by a TOCTOU race in execve(2): when executing a SUID binary, the new address space is installed before credentials are updated, so a same-user process can read or modify memory via procfs/linprocfs during the window. An unprivileged local user can exploit this to gain r...

CVE-2026-49415 Local privilege escalation via execve(2) TOCTOU race

During execve2 of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel's debugging permission check still saw...

EUVD-2026-62236

During execve2 of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel's debugging permission check still saw...

CVE-2026-72118

A flaw was found in the Linux kernel's Controller Area Network CAN Broadcast Manager BCM module. A data race condition, occurring when multiple central processing units CPUs simultaneously process CAN frames, can lead to incorrect statistics being reported. This could result in a bogus or negativ...

UBUNTU-CVE-2026-74479

In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix proc entry use-after-free pktgenchangename replaces pktdev-entry while holding t-iflock. pktgenremovedevice removes the same entry before remdevfromiflist takes that lock. This allows the following interleaving:...

CVE-2026-72297 net: atm: reject out-of-range traffic classes in QoS validation

In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation Reject ATM traffic classes above ATMANYCLASS in checktp. SOATMQOS stores the supplied QoS after checkqos succeeds, so accepting larger values leaves invalid...

EUVD-2026-59076

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN detected a data race within the bcmrxhandler when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. Use atomic operations with...

CVE-2026-72118

CVE-2026-72118 concerns a data race in the Linux kernel CAN subsystem (bcm) where two CPUs simultaneously receive CAN frames, triggering KCSAN complaints in bcm_rx_handler(). The fix uses atomic operations on statistics counters (signed long) in hot paths and refactors updates to bcm_update_rx_st...

CVE-2026-72118 can: bcm: fix CAN frame rx/tx statistics

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN detected a data race within the bcmrxhandler when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. Use atomic operations with...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: procfs: Avoid fetching the build ID while holding the VMA lock. Fix the PROCMAPQUERY to fetch the optional build ID only after releasing the mmaplock or the per-VMA lock, whichever was used to lock the VMA, to prevent deadlock...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: procfs: Fixed a possible double mmput operation in doprocmapquery. When a user provides a buffer of incorrect size for the PROCMAPQUERY build ID, we return an -ENAMETOOLONG error. After recent changes, this condition occurs later...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: procfs: Fixed a missing RCU protection when reading realparent in dotaskstat. When reading /proc/pid/stat, dotaskstat accesses task-realparent without proper RCU protection. This leads to the following sequence of events: cpu 0 c...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fs/proc: fixed a UAF in procreaddirde. The pde is erased from the subdir rbtree through rberase, but the node is not set to EMPTY, which may lead to UAF access. We should use RBCLEARNODE to set the erased node to EMPTY. Then,...

RLSA-2026:49871 Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown CVE-2025-68214 kernel: procfs: avoid fetching build ID while holding VMA lock CVE-2026-23199 Bug Fixes...

kernel: procfs: avoid fetching build ID while holding VMA lock

A deadlock vulnerability was found in the procfs PROCMAPQUERY ioctl handler. When fetching the optional build ID while holding the VMA lock mmaplock, a circular lock dependency can occur with the inode mutex, causing a system deadlock...

RHEL 10 : kernel (RHSA-2026:49871)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49871 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Denial of...

CVE-2026-64371

A flaw was found in the Linux kernel's procfs a virtual filesystem that provides information about running processes. This vulnerability occurs because certain functions within procfs do not properly protect access to process memory information. A local attacker could exploit this missing...

CVE-2026-64371

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess: -...

UBUNTU-CVE-2026-64371

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess: -...

CVE-2026-64371 proc: protect ptrace_may_access() with exec_update_lock (part 1)

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess: -...