CVE-2026-74347: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nfcttimeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being used...

PT-2026-72274

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Xen SCSI backend where scsiback get pend req returns a vscsibk pend with an uninitialized se cmd where cmd kref is 0. In scsiback do cmd fn, two error...

PT-2026-72317

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak occurs in the nvmet sq create function. The issue arises when a reference on the ctrl is acquired using kref get unless zero before the nvmet check sqid function i...

PT-2026-72989

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the Bluetooth ISO implementation. The iso conn ready function accesses the conn-sk socket without holding the conn-lock or a proper refcount. This...

CVE-2026-74537: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk is currently accessed without either: Task 1 Task 2...

Linux Distros Unpatched Vulnerability : CVE-2026-74405

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OPP: Fix race between OPP addition and lookup A race exists between devpmoppadddynamic and devpmoppfindfreqexact: CPU0 add CPU1 lookup...

Linux Distros Unpatched Vulnerability : CVE-2026-72042

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipmi: Fix user refcount underflow in event delivery ipmiallocrecvmsguser takes the temporary user reference owned by the receive message, and ipmifreerecvmsg...

Linux Distros Unpatched Vulnerability : CVE-2026-72308

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mlxsw: fix refcount leak in mlxswspportlagjoin When mlxswspportlagindexget fails, mlxswspportlagjoin returns an error without releasing the lag reference obtain...

CVE-2026-72128: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix refcount leak in nvmetsqcreate In nvmetsqcreate, a reference on the ctrl is taken via krefgetunlesszero before calling nvmetchecksqid. If nvmetchecksqid fails, the function returns the error directly without releasing...

SUSE CVE-2026-68122

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix peer refcount leak in TCP error paths When either the TCP RX or TX error path calls ovpnpeerhold followed by schedulework&peer-tcp.deferdelwork, and the work item is already pending from the other path, schedulework...

SUSE CVE-2026-68177

In the Linux kernel, the following vulnerability has been resolved: tracing: Delay module ref count for "enableevent" trigger Triggers are now delayed from freeing, but can still be triggered until after the RCU grace period has ended. The freeing of the enableevent data is put into the...

SUSE CVE-2026-68391

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hciconn in hcisync callbacks also needs to hold refcount to avoi...

SUSE CVE-2026-68386

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

Linux Distros Unpatched Vulnerability : CVE-2026-68263

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix double call to drmschedentityfini Call sequence of double call:...

Linux Distros Unpatched Vulnerability : CVE-2026-68122

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ovpn: fix peer refcount leak in TCP error paths When either the TCP RX or TX error path call...

Linux Distros Unpatched Vulnerability : CVE-2026-68177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: tracing: Delay module ref count for enableevent trigger Triggers are now delayed from freein...

CVE-2026-68391

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hciconn in hcisync callbacks also needs to hold refcount to avoi...

DEBIAN-CVE-2026-68205

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2asyncregistersubdevsensor The v4l2 helper v4l2asyncregistersubdevsensor calls v4l2asyncregistersubdev, which is a macro that expands to v4l2asyncregistersubdevsd,THISMODULE...

CVE-2026-68174

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

CVE-2026-68263

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix double call to drmschedentityfini Call sequence of double call: pvrcontextdestroy pvrcontextkillqueues pvrqueuekill drmschedentitydestroy drmschedentityfini // here pvrcontextput...