UBUNTU-CVE-2026-64262

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fusereq on io-uring cancel task work When iouring delivers task work with tw.cancel set PFEXITING, PFKTHREAD fallback, or percpurefisdying on the ring context, fuseuringsendintask takes the cancel branch, assigns...

UBUNTU-CVE-2026-64291

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventqdepth upper bound iommufdveventqalloc accepts any !0 veventqdepth from userspace, with an upper bound at U32MAX. This leaves a vulnerability where userspace can allocate excessively large queues to exhaust...

CVE-2026-64525 xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit

In the Linux kernel, the following vulnerability has been resolved: xfrm: move policybydst RCU sync from per-netns .exit to .preexit The struct pernetoperations docstring in include/net/netnamespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking...

CVE-2026-64509

In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build still has fallible work after blkmqallocdisk, but its error path only recovers the foreign queue data. That leaks the temporary gendisk and requestqueue until later...

CVE-2026-64509

The CVE fixes a leak in the Linux kernel rust: block GenDisk cleanup paths. GenDiskBuilder::build() leaves fallible work after __blk_mq_alloc_disk() that can cause the temporary gendisk and request_queue to be retained until teardown, if the caller moves the last Arc<TagSet> into build(). T...

EUVD-2026-48853

In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build still has fallible work after blkmqallocdisk, but its error path only recovers the foreign queue data. That leaks the temporary gendisk and requestqueue until later...

CVE-2026-64509 rust: block: fix GenDisk cleanup paths

In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build still has fallible work after blkmqallocdisk, but its error path only recovers the foreign queue data. That leaks the temporary gendisk and requestqueue until later...

CVE-2026-64509 rust: block: fix GenDisk cleanup paths

In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build still has fallible work after blkmqallocdisk, but its error path only recovers the foreign queue data. That leaks the temporary gendisk and requestqueue until later...

EUVD-2026-48848

In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count bmc150accelfifoflush copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 bufferBMC150ACCELFIFOLENGTH 3; which is sized fo...

CVE-2026-64457

The CVE-2026-64457 issue affects the Linux kernel’s virtio_pci subsystem. When unbinding a virtio balloon device (e.g., echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind), a NULL pointer dereference can occur due to a mismatch between sparse queue indices and dense queue indices (ho...

EUVD-2026-48801

In the Linux kernel, the following vulnerability has been resolved: virtiopci: fix vq info pointer lookup via wrong index Unbinding a virtio balloon device: echo virtio0 /sys/bus/virtio/drivers/virtioballoon/unbind triggers a NULL pointer dereference. The dmesg says: BUG: kernel NULL pointer...

CVE-2026-64438

Summary of CVE-2026-64438 : In the Linux kernel’s crypto: qat path, a race during VF2PF teardown could cause use-after-free of per-VF state (vf_info) due to tearing down per-VF locks and state before in-flight VF2PF work completes. The fix introduces a PF-local flag (vf2pf_disabled) that gates wo...

CVE-2026-64438 crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adfdisablesriov The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state struct adfaccelvfinfo. Currently, adfdisablesriov destroys per-VF...

EUVD-2026-48779

In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skbqueuelen readers on auditqueue Multiple readers access auditqueue.qlen via skbqueuelen without holding the queue lock or using READONCE, while kauditd writes to this field via the skbdequeue → skbunlin...

CVE-2026-64435 audit: Fix data races of skb_queue_len() readers on audit_queue

In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skbqueuelen readers on auditqueue Multiple readers access auditqueue.qlen via skbqueuelen without holding the queue lock or using READONCE, while kauditd writes to this field via the skbdequeue → skbunlin...

CVE-2026-64435

CVE-2026-64435 documents a data race in the Linux kernel where multiple readers access audit_queue.qlen via skb_queue_len() without proper synchronization while kauditd writes through skb_dequeue()/__skb_unlink() under WRITE_ONCE() with a spinlock. The race is demonstrated by a conflicting access...

CVE-2026-64435 audit: Fix data races of skb_queue_len() readers on audit_queue

In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skbqueuelen readers on auditqueue Multiple readers access auditqueue.qlen via skbqueuelen without holding the queue lock or using READONCE, while kauditd writes to this field via the skbdequeue → skbunlin...

CVE-2026-64435

In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skbqueuelen readers on auditqueue Multiple readers access auditqueue.qlen via skbqueuelen without holding the queue lock or using READONCE, while kauditd writes to this field via the skbdequeue → skbunlin...

CVE-2026-64435

In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skbqueuelen readers on auditqueue Multiple readers access auditqueue.qlen via skbqueuelen without holding the queue lock or using READONCE, while kauditd writes to this field via the skbdequeue → skbunlin...

CVE-2026-64425 io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: re-check IOWQBITEXIT for each linked work item commit 10dc95939817 "iouring/io-wq: check IOWQBITEXIT inside work run loop" fixed the obvious case where ioworkerhandlework took one exit-bit snapshot before draining...