CVE-2026-64162

CVE-2026-64162 concerns the Linux kernel idpf driver: a read_dev_clk_lock spinlock could be used before initialization because the lock was not initialized before ptp aux work could run. The issue arises when idpf_ptp_init() initializes read_dev_clk_lock after ptp_schedule_worker() has started an...

CVE-2026-64139

CVE-2026-64139 : In the Linux kernel ksmbd path, a memory-leak exists in set_posix_acl_entries_dacl() on overflow. The loop allocates a struct smb_sid with kmalloc_obj() each iteration and relies on per-iteration kfree() at loop end. Introduced break paths skip these frees, causing the sid buffer...

CVE-2026-64137 smb: client: require net admin for CIFS SWN netlink

In the Linux kernel, the following vulnerability has been resolved: smb: client: require net admin for CIFS SWN netlink CIFSGENLCMDSWNNOTIFY is the userspace witness-notify command. The intended sender is the cifs.witness helper, but the generic-netlink operation currently has no capability flag,...

CVE-2026-64136

In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tccount increment in smb2findsmbsesstconunlocked Commit 96c4af418586 "cifs: Fix locking usage for tcon fields" refactored cifs code to change cifstcpseslock for tclock around tccount changes. There was missin...

CVE-2026-64132 ipv6: ioam: refresh hdr pointer before ioam6_event()

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6event Reported by Sashiko: In ipv6hopioam, the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skbensurewritable, which might reallocate the...

CVE-2026-64127 Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: ecredreconfigure: send packed pdu, not stack pointer Commit 1c08108f3014 "Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings" converted the on-stack request PDU in l2capecredreconfigure from an...

CVE-2026-64127

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: ecredreconfigure: send packed pdu, not stack pointer Commit 1c08108f3014 "Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings" converted the on-stack request PDU in l2capecredreconfigure from an...

CVE-2026-64127 Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: ecredreconfigure: send packed pdu, not stack pointer Commit 1c08108f3014 "Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings" converted the on-stack request PDU in l2capecredreconfigure from an...

CVE-2026-64127

CVE-2026-64127 affects the Linux kernel Bluetooth L2CAP handling. The root cause, after a patch, was an incorrect use of DEFINE_RAW_FLEX() in l2cap_ecred_reconfigure(): the on-stack PDU size and source pointer were not adjusted, causing 8-byte data being copied from the stack instead of the inten...

EUVD-2026-45808

In the Linux kernel, the following vulnerability has been resolved: net: hsr: defer node table free until after RCU readers HSR node-list and node-status generic-netlink operations run under rcureadlock. They walk hsr-nodedb through hsrgetnextnode and hsrgetnodedata, but RTMDELLINK teardown remov...

EUVD-2026-45799

In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IPHDRINCL packets with ihl ihl 4; err = -EINVAL; if iphlen length goto errorfree; if iphlen = sizeofiph / fix up saddr, totlen, id, csum, transportheader / It does not, however, reject ihl = sizeofiph" branch is...

CVE-2026-64101 fwctl: pds: Validate RPC input size before parsing

In the Linux kernel, the following vulnerability has been resolved: fwctl: pds: Validate RPC input size before parsing The fwctl core allocates the device-specific RPC input buffer with fwctlrpc.inlen and passes that buffer to the driver callback. pdsfcfwrpc casts the buffer to struct fwctlrpcpds...

CVE-2026-64102

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field chdr-mpalen, 16 bit big-endian, peer-controlled is smaller than the fixed DDP/RDMA...

EUVD-2026-45779

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Without rtnllock held, a hardif might be retrieved as primary interface of a meshif, but then while operating on this interface getting decoupled from the mesh...

CVE-2026-64094

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Without rtnllock held, a hardif might be retrieved as primary interface of a meshif, but then while operating on this interface getting decoupled from the mesh...

CVE-2026-64085

The CVE describes a Linux kernel hwmon issue (adm1266) where adm1266_pmbus_block_xfer() copies a device-supplied block payload into a caller buffer using msgs[1].buf[0] as length. The helper may write more than the protected ADM1266_BLACKBOX_SIZE (64 bytes), while the caller advances read_buff in...

CVE-2026-64072

In the Linux kernel, the following vulnerability has been resolved: nvme: fix bio leak on mapping failure The local bio is always NULL, so we'd leak the bio if the integrity mapping failed. Just get it directly from the request...

CVE-2026-64048

In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ismdev slot On the SMC-D client, slot 0 of ini-ismdev/ini-ismchid is reserved for an SMC-Dv1 device. smcfindismv2deviceclnt populates V2 entries starting at index 1, so when no ...

CVE-2026-64044

Concrete details confirm CVE-2026-64044 fix in the Linux kernel’s OpenVPN peer handling. The error path in ovpn_nl_peer_new_doit() previously called ovpn_peer_release() directly instead of ovpn_peer_put(), bypassing the kref, risking use-after-free when a caller holds a ref during an in-flight op...

CVE-2026-64044 ovpn: respect peer refcount in CMD_NEW_PEER error path

In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMDNEWPEER error path ovpnnlpeernewdoit's error path calls ovpnpeerrelease directly rather than ovpnpeerput, bypassing the kref. The accompanying comment "peer was not yet hashed, thus it is not use...