CVE-2026-53248 net: airoha: Fix use-after-free in metadata dst teardown

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix use-after-free in metadata dst teardown airohametadatadstfree runs metadatadstfree which frees the metadatadst with kfree immediately, bypassing the RCU grace period. In the RX path, skbdstsetnoref sets a...

CVE-2026-53248

In Linux kernel, the airoha net driver has a use-after-free in metadata_dst teardown (CVE-2026-53248). The airoha_metadata_dst_free() function frees the metadata_dst with kfree() immediately, bypassing the RCU grace period, while the RX path may hold a non-refcounted pointer from skb to the dst v...

CVE-2026-53190

CVE-2026-53190 concerns a Linux kernel vulnerability in the drm/virtio path where a refcount leak could occur in error handling of virtio_gpu_dma_fence_wait(). The root cause is that dma_fence_unwrap_for_each() calls dma_fence_unwrap_first(), which assigns cursor->chain = dma_fence_get(head) (...

CVE-2026-53190

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix dmafence refcount leak on error in virtiogpudmafencewait dmafenceunwrapforeach internally calls dmafenceunwrapfirst which does cursor-chain = dmafencegethead, taking an extra reference. On normal loop completion,...

CVE-2026-53190 drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix dmafence refcount leak on error in virtiogpudmafencewait dmafenceunwrapforeach internally calls dmafenceunwrapfirst which does cursor-chain = dmafencegethead, taking an extra reference. On normal loop completion,...

CVE-2026-53190 drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix dmafence refcount leak on error in virtiogpudmafencewait dmafenceunwrapforeach internally calls dmafenceunwrapfirst which does cursor-chain = dmafencegethead, taking an extra reference. On normal loop completion,...

Linux Distros Unpatched Vulnerability : CVE-2026-52947

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: qrtr: fix refcount saturation and potential UAF in qrtrportremove In qrtrportremove, the socket reference count is decremented via sockput before the port ...

PT-2026-52364

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the netfilter synproxy infrastructure. This occurs because netfilter hooks are registered on-demand when a user adds the first iptables target or nftables...

PT-2026-52355

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the TCP implementation where a reference count underflow can occur in the inet csk reqsk queue drop function, potentially leading to a use-after-free condition. This...

PT-2026-52286

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak occurs in the virtio gpu dma fence wait function within the drm/virtio component. The issue arises because dma fence unwrap for each calls dma fence unwrap first,...

CVE-2026-52947

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtrportremove In qrtrportremove, the socket reference count is decremented via sockput before the port is removed from the qrtrports XArray and before the RCU grace period...

CVE-2026-53089 bpf: Fix use-after-free in offloaded map/prog info fill

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in offloaded map/prog info fill When querying info for an offloaded BPF map or program, bpfmapoffloadinfofillns and bpfprogoffloadinfofillns obtain the network namespace with getnetdevnetoffmap-netdev...

CVE-2026-52947 net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtrportremove In qrtrportremove, the socket reference count is decremented via sockput before the port is removed from the qrtrports XArray and before the RCU grace period...

CVE-2026-52947

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtrportremove In qrtrportremove, the socket reference count is decremented via sockput before the port is removed from the qrtrports XArray and before the RCU grace period...

CVE-2026-52947

The CVE-2026-52947 issue affects the Linux kernel qrtr subsystem, specifically in qrtr_port_remove(), where the socket reference count is decremented via __sock_put() before the port is removed from the qrtr_ports XArray and before the RCU grace period elapses. This creates a race window where a ...

CVE-2026-52947 net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtrportremove In qrtrportremove, the socket reference count is decremented via sockput before the port is removed from the qrtrports XArray and before the RCU grace period...

PT-2026-51731

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the BPF Berkeley Packet Filter subsystem. The function bpf selem unlink nofail sets the smap variable to NULL before removing the element from the...

PT-2026-51841

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qrtr port remove function where the socket reference count is decremented using sock put before the port is removed from the qrtr ports XArray and before the RCU...

PT-2026-52003

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the powerpc architecture's page table fragment management. The system uses pt frag refcount to track page table fragments. When pte free defer is called during madvise...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: afunix: Do not use GC if MSGPEEK occurred. Igor Ushakov reported that GC purged the receive queue of a live socket due to a race with MSGPEEK, with a fix provided. This is exactly the same issue that was previously fixed in the...