CVE-2026-93226

The Linux kernel contains a race condition in the ipv6 networking stack. The function rt6_nh_dump_exceptions() improperly uses hlist_for_each_entry() to iterate over RCU-protected exception lists . Because the caller holds rcu_read_lock() but fails to hold rt6_exception_lock, the function rt6_ins...

CVE-2026-93226 ipv6: use RCU iterator to dump route exceptions

In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU iterator to dump route exceptions rt6nhdumpexceptions uses hlistforeachentry to iterate over RCU-protected exception lists. The caller holds rcureadlock, but does not hold rt6exceptionlock, so rt6insertexception can...

CVE-2026-89759 mm/kmemleak: avoid soft lockup when scanning task stacks

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup when scanning task stacks Patch series "mm/kmemleak: avoid soft lockup when scanning task", v3. kmemleakscan scans every task stack under one rcureadlock with no reschedule point, which can trip the...

CVE-2026-89759: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup when scanning task stacks Patch series "mm/kmemleak: avoid soft lockup when scanning task", v3. kmemleakscan scans every task stack under one rcureadlock with no reschedule point, which can trip the...

CVE-2026-74338

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject sleepable BPFLSMCGROUP programs at load time The cgroup shim runs under rcureadlockdontmigrate, so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts to lo...

CVE-2026-72385 tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry()

In the Linux kernel, the following vulnerability has been resolved: tracing/fprobe: Fix NULL pointer dereference in fprobefgraphentry fprobefgraphentry sizes a shadow-stack reservation in one walk of the per-ip fprobe list and fills it in a second walk, both under rcureadlock only. A fprobe...

CVE-2026-72385 tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry()

In the Linux kernel, the following vulnerability has been resolved: tracing/fprobe: Fix NULL pointer dereference in fprobefgraphentry fprobefgraphentry sizes a shadow-stack reservation in one walk of the per-ip fprobe list and fills it in a second walk, both under rcureadlock only. A fprobe...

CVE-2026-68393: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: extend connhash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hciconnhash lookup...

CVE-2026-64419: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: do not hold RCU lock in shrinkerdebugfscountshow Reading the debugfs "count" file of a memcg-aware shrinker can sleep inside an RCU read-side critical section: BUG: sleeping function called from invalid context at...

EUVD-2026-46009

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ipsetlist resize The release path of ipsetdumpdo and ipsetdumpdone read inst-ipsetlist via ipsetrefnetlink, a plain rcudereferenceraw of the array pointer. These run from netlinkrecvmsg...

CVE-2026-63865: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop tasktoinode and inetconnestablished from lsm sleepable hooks bpflsmtasktoinode is called under rcureadlock and bpflsminetconnestablished is called from softirq context, so neither hook can be used by sleepable LSM...

CVE-2026-64123: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: hsr: defer node table free until after RCU readers HSR node-list and node-status generic-netlink operations run under rcureadlock. They walk hsr-nodedb through hsrgetnextnode and hsrgetnodedata, but RTMDELLINK teardown remov...

CVE-2026-64045: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - use cached peer pointer in ovpntcpclose ovpntcpclose loads the ovpnsocket via rcudereferenceskuserdata under rcureadlock, takes a reference on sock-peer, caches the peer pointer in a local, and drops the read lock. It...

CVE-2026-53128: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drbd: Balance RCU calls in drbdadmdumpdevices Make drbdadmdumpdevices call rcureadlock before rcureadunlock is called. This has been detected by the Clang thread-safety analyzer...

CVE-2025-68374: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md: fix rcu protection in mdwakeupthread We attempted to use RCU to protect the pointer 'thread', but directly passed the value when calling mdwakeupthread. This means that the RCU pointer has been acquired before rcureadlock,...

CVE-2025-40139: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smc: Use skdstget and dstdevrcu in in smcclcprfxset. smcclcprfxset is called during connect and not under RCU nor RTNL. Using skdstgetsk-dev could trigger UAF. Let's use skdstget and devdstrcu under rcureadlock after...

EUVD-2024-53302

Malicious code in bioql PyPI...

CVE-2025-38003: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu read protection for procfs content When the procfs content is generated for a bcmop which is in the process to be removed the procfs output might show unreliable data UAF. As the removal of bcmop's is...

AZL-62633 CVE-2024-57875 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: block: RCU protect disk-convzonesbitmap Ensure that a disk revalidation changing the conventional zones bitmap of a disk does not cause invalid memory references when using the diskzoneisconv helper by RCU protecting the...

CVE-2024-56654

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fix using rcureadunlock while iterating The usage of rcureadunlock while inside listforeachentryrcu is not safe since for the most part entries fetched this way shall be treated as rcudereference: Note that t...