PT-2026-72271

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix refcount leak in efct hw io abort When efct hw reqtag alloc fails in efct hw io abort, the error path returns -ENOSPC without releasing the reference obtained via kref get unless zero earlier in the function...

PT-2026-72983

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci conn: hold conn reference in abort conn sync There is theoretical UAF if the conn is freed while the hci sync task is running. Hold refcount to avoid that...

PT-2026-72700

In the Linux kernel, the following vulnerability has been resolved: net: watchdog: fix refcount tracking races Blamed commit converted the untracked dev hold/dev put calls in the watchdog code to use the tracked dev hold track/dev put track which were later renamed/interfaced to netdev hold and...

PT-2026-72274

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsiback get pend req obtains a command tag and returns a vscsibk pend whose embedded se cmd has only been memset to 0, so its cmd kref is 0; the se cmd i...

PT-2026-72516

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdna umap lifetime race amdxdna umap release calls the blocking mmu interval notifier remove before removing the object from abo-mem.umap list. If aie2 populate range runs concurrently, it may obta...

PT-2026-72231

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmi alloc recv msguser takes the temporary user reference owned by the receive message, and ipmi free recv msg drops it again. If event delivery fails after allocating receive...

PT-2026-72649

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the sk ctx Currently update sk ctx transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller conditionally put the...

PT-2026-72495

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw sp vrs lpm tree replace When mlxsw sp vrs lpm tree replace fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the...

PT-2026-72370

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: fix refcount leak in is full charged In is full charged, power supply get by name is called to obtain a reference to the fuel gauge power supply. If the voltage check uV = desc-fullbatt uV succeeds...

PT-2026-72527

In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on build skb failure qede rx build skb and qede tpa rx build skb do not check for a NULL return from qede build skb. When it returns NULL under memory pressure, the functions still...

PT-2026-72406

In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm file refcount leak on cached nlm do fopen failure The cached-file path in nlm lookup file reaches the found: label unconditionally, even when nlm do fopen fails. At that label result and file-f count are updated...

PT-2026-72783

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nf ct timeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being us...

Linux Distros Unpatched Vulnerability : CVE-2026-72113

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: bcm: add missing device refcount for CAN filter removal sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is...

Linux Distros Unpatched Vulnerability : CVE-2026-74264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: watchdog: fix refcount tracking races Blamed commit converted the untracked devhold/devput calls in the watchdog code to use the tracked...

PT-2026-72478

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix GISC refcount leak on AIF enable failure kvm s390 gisc register registers the guest ISC before pinning the guest interrupt forwarding pages and allocating the AISB bit. If any of the later setup steps fails, t...

PT-2026-72317

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix refcount leak in nvmet sq create In nvmet sq create, a reference on the ctrl is taken via kref get unless zero before calling nvmet check sqid. If nvmet check sqid fails, the function returns the error directly without...

PT-2026-72724

In the Linux kernel, the following vulnerability has been resolved: net: fib rules: Don't dump dying fib rule in fib rules dump. rocker router fib event calls fib rule get during RCU dump. If the fib rule is dying, refcount inc will complain about it. Let's call refcount inc not zero in fib rules...

PT-2026-72965

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmb node in loopback attach/detach/unregister dibs lo attach dmb, dibs lo detach dmb and dibs lo unregister dmb look up the dmb node under dmb ht lock, drop the lock and only then operate on the node's...

Linux Distros Unpatched Vulnerability : CVE-2026-72308

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mlxsw: fix refcount leak in mlxswspportlagjoin When mlxswspportlagindexget fails, mlxswspportlagjoin returns an error without releasing the lag reference obtain...

Linux Distros Unpatched Vulnerability : CVE-2026-74405

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OPP: Fix race between OPP addition and lookup A race exists between devpmoppadddynamic and devpmoppfindfreqexact: CPU0 add CPU1 lookup...