CVE-2026-74347

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nfcttimeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being used...

CVE-2026-74347 netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nfcttimeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being used...

CVE-2026-74344

CVE-2026-74344 affects the Linux kernel BPF RB-tree code. The vulnerability arises in bpf_rb_root_free() when detaching the root: the function copies rb_root_cached, replaces the live root with RB_ROOT_CACHED, and then walks the copied tree to drop objects. If a dropped object is refcounted and s...

CVE-2026-74289 ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't dump dying fibinfo in fibleafnotify. syzbot reported use-after-free in nsimfib4prepareevent. 0 The problem is that the following functions call fibinfohold / refcountinc while dumping fibinfo under RCU, which is...

CVE-2026-74289

CVE-2026-74289 (Linux kernel) : A use-after-free bug occurs when dumping IPv4 fib_info under RCUs because fib_info_hold()/refcount_inc() are called while lifetime can’t be guaranteed. Affected: nsim_fib4_prepare_event(), mlxsw_sp_router_fib4_event(), rocker_router_fib_event(), and related fib_tri...

CVE-2026-74288

The vulnerability CVE-2026-74288 affects the Linux kernel, specifically in the networking subsystem’s fib_rules handling. The issue arises in net: fib_rules_dump() when rocker_router_fib_event() calls fib_rule_get() during an RCU dump and encounters a dying fib_rule whose refcount is zero or bein...

CVE-2026-74288 net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().

In the Linux kernel, the following vulnerability has been resolved: net: fibrules: Don't dump dying fibrule in fibrulesdump. rockerrouterfibevent calls fibruleget during RCU dump. If the fibrule is dying, refcountinc will complain about it. Let's call refcountincnotzero in fibrulesdump...

EUVD-2026-59435

In the Linux kernel, the following vulnerability has been resolved: net: fibrules: Don't dump dying fibrule in fibrulesdump. rockerrouterfibevent calls fibruleget during RCU dump. If the fibrule is dying, refcountinc will complain about it. Let's call refcountincnotzero in fibrulesdump...

CVE-2026-74288 net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().

In the Linux kernel, the following vulnerability has been resolved: net: fibrules: Don't dump dying fibrule in fibrulesdump. rockerrouterfibevent calls fibruleget during RCU dump. If the fibrule is dying, refcountinc will complain about it. Let's call refcountincnotzero in fibrulesdump...

CVE-2026-74264 net: watchdog: fix refcount tracking races

In the Linux kernel, the following vulnerability has been resolved: net: watchdog: fix refcount tracking races Blamed commit converted the untracked devhold/devput calls in the watchdog code to use the tracked devholdtrack/devputtrack which were later renamed/interfaced to netdevhold and netdevpu...

EUVD-2026-59411

In the Linux kernel, the following vulnerability has been resolved: net: watchdog: fix refcount tracking races Blamed commit converted the untracked devhold/devput calls in the watchdog code to use the tracked devholdtrack/devputtrack which were later renamed/interfaced to netdevhold and netdevpu...

CVE-2026-74264

CVE-2026-74264 affects the Linux kernel watchdog code. The root issue is a race in refcount tracking between netdev_watchdog_up() and dev_watchdog(), caused by using dev->watchdog_dev_tracker without proper synchronization, which could lead to a use-after-free and list corruption (list_del cor...

CVE-2026-74264 net: watchdog: fix refcount tracking races

In the Linux kernel, the following vulnerability has been resolved: net: watchdog: fix refcount tracking races Blamed commit converted the untracked devhold/devput calls in the watchdog code to use the tracked devholdtrack/devputtrack which were later renamed/interfaced to netdevhold and netdevpu...

CVE-2026-72473 xprtrdma: Decouple req recycling from RPC completion

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decouple req recycling from RPC completion rlkref formerly served two distinct lifetimes through a single refcount: it gated when a Reply could wake its RPC task, and it gated when an rpcrdmareq could return to its free...

EUVD-2026-59372

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decouple req recycling from RPC completion rlkref formerly served two distinct lifetimes through a single refcount: it gated when a Reply could wake its RPC task, and it gated when an rpcrdmareq could return to its free...

CVE-2026-72473

Affected software: Linux kernel (xprtrdma RPC path). Vulnerability: a race/lifecycle issue in rl_kref and send-side references within rpcrdma/xprt_rdma code caused improper freeing of request buffers while a DMA operation could still be active. Root cause: rl_kref previously gated two lifetimes w...

CVE-2026-72461 apparmor: fix refcount leak when updating the sk_ctx

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the skctx Currently updateskctx transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller conditionally put the referenc...

EUVD-2026-59360

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the skctx Currently updateskctx transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller conditionally put the referenc...

CVE-2026-72461

Vulnerability CVE-2026-72461 affects the Linux kernel with AppArmor: a refcount leak in updating the sk_ctx. Root cause: update_sk_ctx() transfers the plabel reference but also unconditionally releases it in the caller; the fix is to obtain a proper reference and avoid double-free. Affected compo...

CVE-2026-72461 apparmor: fix refcount leak when updating the sk_ctx

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the skctx Currently updateskctx transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller conditionally put the referenc...