PT-2026-72231

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmi alloc recv msguser takes the temporary user reference owned by the receive message, and ipmi free recv msg drops it again. If event delivery fails after allocating receive...

PT-2026-72649

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the sk ctx Currently update sk ctx transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller conditionally put the...

PT-2026-72317

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix refcount leak in nvmet sq create In nvmet sq create, a reference on the ctrl is taken via kref get unless zero before calling nvmet check sqid. If nvmet check sqid fails, the function returns the error directly without...

PT-2026-72443

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf queue: pin bridge device while NFQUEUE holds fake dst The br netfilter fake rtable is embedded in struct net bridge and is attached to bridged packets with skb dst set noref. If such a packet is queued to NFQUEUE, n...

PT-2026-72724

In the Linux kernel, the following vulnerability has been resolved: net: fib rules: Don't dump dying fib rule in fib rules dump. rocker router fib event calls fib rule get during RCU dump. If the fib rule is dying, refcount inc will complain about it. Let's call refcount inc not zero in fib rules...

PT-2026-72752

In the Linux kernel, the following vulnerability has been resolved: NFSD: Handle layout stid in nfsd4 drop revoked stid nfsd4 drop revoked stid has no SC TYPE LAYOUT case, so when a client sends FREE STATEID for an admin-revoked layout stid, the default branch releases cl lock and returns without...

PT-2026-72965

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmb node in loopback attach/detach/unregister dibs lo attach dmb, dibs lo detach dmb and dibs lo unregister dmb look up the dmb node under dmb ht lock, drop the lock and only then operate on the node's...

PT-2026-72211

In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llc ui autobind llc ui autobind opens a SAP after choosing a dynamic LSAP. llc sap open returns a reference owned by the caller, and llc sap add socket takes a second reference for the socket's...

Linux Distros Unpatched Vulnerability : CVE-2026-72042

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipmi: Fix user refcount underflow in event delivery ipmiallocrecvmsguser takes the temporary user reference owned by the receive message, and ipmifreerecvmsg...

Linux Distros Unpatched Vulnerability : CVE-2026-74405

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OPP: Fix race between OPP addition and lookup A race exists between devpmoppadddynamic and devpmoppfindfreqexact: CPU0 add CPU1 lookup...

Linux Distros Unpatched Vulnerability : CVE-2026-72308

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mlxsw: fix refcount leak in mlxswspportlagjoin When mlxswspportlagindexget fails, mlxswspportlagjoin returns an error without releasing the lag reference obtain...

Linux Distros Unpatched Vulnerability : CVE-2026-68263

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/imagination: Fix double call to drmschedentityfini Call sequence of double call: pvrcontextdestroy pvrcontextkillqueues pvrqueuekill drmschedentitydestroy...

Linux Distros Unpatched Vulnerability : CVE-2026-68122

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ovpn: fix peer refcount leak in TCP error paths When either the TCP RX or TX error path calls ovpnpeerhold followed by schedulework&peer-tcp.deferdelwork, and t...

Linux Distros Unpatched Vulnerability : CVE-2026-68177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Delay module ref count for enableevent trigger Triggers are now delayed from freeing, but can still be triggered until after the RCU grace period has...

CVE-2026-68391

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hciconn in hcisync callbacks also needs to hold refcount to avoi...

DEBIAN-CVE-2026-68205

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2asyncregistersubdevsensor The v4l2 helper v4l2asyncregistersubdevsensor calls v4l2asyncregistersubdev, which is a macro that expands to v4l2asyncregistersubdevsd,THISMODULE...

CVE-2026-68174

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

UBUNTU-CVE-2026-68177

In the Linux kernel, the following vulnerability has been resolved: tracing: Delay module ref count for "enableevent" trigger Triggers are now delayed from freeing, but can still be triggered until after the RCU grace period has ended. The freeing of the enableevent data is put into the...

UBUNTU-CVE-2026-68386

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

CVE-2026-68177

In the Linux kernel, the following vulnerability has been resolved: tracing: Delay module ref count for "enableevent" trigger Triggers are now delayed from freeing, but can still be triggered until after the RCU grace period has ended. The freeing of the enableevent data is put into the...