CVE-2026-72022 llc: fix SAP refcount leak in llc_ui_autobind()

In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llcuiautobind llcuiautobind opens a SAP after choosing a dynamic LSAP. llcsapopen returns a reference owned by the caller, and llcsapaddsocket takes a second reference for the socket's membership in...

CVE-2026-72022 llc: fix SAP refcount leak in llc_ui_autobind()

In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llcuiautobind llcuiautobind opens a SAP after choosing a dynamic LSAP. llcsapopen returns a reference owned by the caller, and llcsapaddsocket takes a second reference for the socket's membership in...

CVE-2026-72022

Summary: The Linux kernel patch fixes a refcount leak in SAP handling within llc_ui_autobind(). The function opens a SAP after selecting a dynamic LSAP; llc_sap_open() returns a caller-owned reference and llc_sap_add_socket() adds a second reference for socket membership. llc_ui_bind() drops the ...

EUVD-2026-58980

In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llcuiautobind llcuiautobind opens a SAP after choosing a dynamic LSAP. llcsapopen returns a reference owned by the caller, and llcsapaddsocket takes a second reference for the socket's membership in...

PT-2026-72271

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix refcount leak in efct hw io abort When efct hw reqtag alloc fails in efct hw io abort, the error path returns -ENOSPC without releasing the reference obtained via kref get unless zero earlier in the function...

PT-2026-72496

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw sp port lag join When mlxsw sp port lag index get fails, mlxsw sp port lag join returns an error without releasing the lag reference obtained by the earlier mlxsw sp lag get. All other error path...

PT-2026-72274

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsiback get pend req obtains a command tag and returns a vscsibk pend whose embedded se cmd has only been memset to 0, so its cmd kref is 0; the se cmd i...

PT-2026-72989

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in iso conn ready sk deref in iso conn ready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk is currently accessed without either: Task 1 Task 2 iso...

PT-2026-72980

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: hold conn in hci past sync callback Avoids giving freed pointers to hci conn valid, which kmalloc may have reused. Hold refcount to avoid that...

PT-2026-72983

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci conn: hold conn reference in abort conn sync There is theoretical UAF if the conn is freed while the hci sync task is running. Hold refcount to avoid that...

PT-2026-72700

In the Linux kernel, the following vulnerability has been resolved: net: watchdog: fix refcount tracking races Blamed commit converted the untracked dev hold/dev put calls in the watchdog code to use the tracked dev hold track/dev put track which were later renamed/interfaced to netdev hold and...

PT-2026-72516

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdna umap lifetime race amdxdna umap release calls the blocking mmu interval notifier remove before removing the object from abo-mem.umap list. If aie2 populate range runs concurrently, it may obta...

PT-2026-72783

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nf ct timeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being us...

PT-2026-72406

In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm file refcount leak on cached nlm do fopen failure The cached-file path in nlm lookup file reaches the found: label unconditionally, even when nlm do fopen fails. At that label result and file-f count are updated...

PT-2026-72231

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmi alloc recv msguser takes the temporary user reference owned by the receive message, and ipmi free recv msg drops it again. If event delivery fails after allocating receive...

PT-2026-72370

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: fix refcount leak in is full charged In is full charged, power supply get by name is called to obtain a reference to the fuel gauge power supply. If the voltage check uV = desc-fullbatt uV succeeds...

Linux Distros Unpatched Vulnerability : CVE-2026-72113

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: bcm: add missing device refcount for CAN filter removal sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is...

Linux Distros Unpatched Vulnerability : CVE-2026-74264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: watchdog: fix refcount tracking races Blamed commit converted the untracked devhold/devput calls in the watchdog code to use the tracked...

PT-2026-72478

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix GISC refcount leak on AIF enable failure kvm s390 gisc register registers the guest ISC before pinning the guest interrupt forwarding pages and allocating the AISB bit. If any of the later setup steps fails, t...

PT-2026-72527

In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on build skb failure qede rx build skb and qede tpa rx build skb do not check for a NULL return from qede build skb. When it returns NULL under memory pressure, the functions still...