CVE-2026-74721

A vulnerability in the Linux kernel's accel/amxdna driver (AMD DNA accelerator) involves two error paths in amdxdna_insert_pages() that incorrectly call vma->vm_ops->close(vma) before the mmap syscall returns. This prematurely drops the shmem pages_pin_count and the GEM object reference bac...

EUVD-2026-64408

In the Linux kernel, the following vulnerability has been resolved: accel/amxdna: Fix page-insertion errors in amdxdnainsertpages Two error paths in amdxdnainsertpages called vma-vmops-closevma before returning an error code to the caller. This is incorrect: amdxdnagemobjmmap registers an HMM...

CVE-2026-74721 accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()

In the Linux kernel, the following vulnerability has been resolved: accel/amxdna: Fix page-insertion errors in amdxdnainsertpages Two error paths in amdxdnainsertpages called vma-vmops-closevma before returning an error code to the caller. This is incorrect: amdxdnagemobjmmap registers an HMM...

PT-2026-79726

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the amdxdna insert pages function where two error paths incorrectly call vma-vm ops-closevma before returning an error code. This occurs because amdxdna gem obj mmap...

Linux Distros Unpatched Vulnerability : CVE-2026-74721

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/amxdna: Fix page-insertion errors in amdxdnainsertpages Two error paths in amdxdnainsertpages called vma-vmops-closevma before returning an error code to...

CVE-2026-74721: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/amxdna: Fix page-insertion errors in amdxdnainsertpages Two error paths in amdxdnainsertpages called vma-vmops-closevma before returning an error code to the caller. This is incorrect: amdxdnagemobjmmap registers an HMM...

kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4

A flaw was found in the Linux kernel's AMD GPU amdgpu driver. Incorrect management of graphics memory dmafence references within the amdgpugemvaioctl function can lead to a reference count underflow and a use-after-after-free condition. A local attacker could exploit this vulnerability to trigger...

kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4

A flaw was found in the Linux kernel's AMD GPU amdgpu driver. Incorrect management of graphics memory dmafence references within the amdgpugemvaioctl function can lead to a reference count underflow and a use-after-after-free condition. A local attacker could exploit this vulnerability to trigger...

CVE-2026-49419

The FreeBSD operating system (versions 15.0 and later ) is vulnerable to a prison reference count underflow in the kern_jail_set() and kern_jail_get() functions. When the JAIL_AT_DESC flag is used, the system incorrectly releases a reference to the caller's current prison before searching for the...

CVE-2026-49419: Improper Update of Reference Count

When the JAILATDESC flag is specified, kernjailset and kernjailget released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a...

CVE-2026-72042

A flaw was found in the Linux kernel's Intelligent Platform Management Interface IPMI subsystem. An issue in the event delivery mechanism, specifically a reference count underflow, can lead to a use-after-free vulnerability. This occurs when a user's reference count is prematurely decremented...

PT-2026-68081

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xfrm6 fill dst function where the dst.dev is not cleared during an error path when in6 dev getdev returns NULL. In this scenario, the function releases the device...

CVE-2026-64534

A flaw was found in the Linux kernel's NVMe over TCP target nvmet-tcp implementation. When a data digest mismatch is detected, nvmetrequninit is called unconditionally, but if the command was already in the INITFAILED state, the matching percpureftrygetlive was never performed. The resulting...

SUSE CVE-2026-64534

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command arrived via the...

CVE-2026-64534 nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command arrived via the...

CVE-2026-64534 nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command arrived via the...

FreeBSD-SA-26:38.jail

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:38.jail Security Advisory The FreeBSD Project Topic: Jail reference count underflow Category: core Module: jail Announced: 2026-06-30 Credits: Yuxiang Yang,...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Remove the improper idxdfree The call to idxdfree introduces a duplicate putdevice call, resulting in a reference count underflow: refcountt: underflow; use-after-free. WARNING: CPU: 15, PID: 4428, at...

CVE-2026-45910

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix race condition in QP timer handlers I encontered the following warning: WARNING: drivers/infiniband/sw/rxe/rxetask.c:249 at rxeschedtask+0x1c8/0x238 rdmarxe, CPU0: swapper/0/0 ... libsha1 last unloaded: ip6udptunnel...

CVE-2026-45910

The CVE-2026-45910 issue affects the Linux kernel RDMA/rxe driver, caused by a race between retransmit_timer() and rxe_destroy_qp that can drop a Queue Pair (QP) reference count to zero during timer handling. Public documents describe a use-after-free risk and refcount underflow in affected flows...