CVE-2026-74568

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Fix race between LPI release and re-registration Fix a potential race between decrementing an LPI's reference count and evicting that structure from the LPI xarray. LPI structures are maintained in the VGIC LPI...

CVE-2026-74564

In the Linux kernel, the following vulnerability has been resolved: netfilter: xthashlimit: validate hashtable supports XTHASHLIMITRATEMATCH The XTHASHLIMITRATEMATCH flag mode changes the semantics of the dsthashent structure which represents an entry in the hashtable. There is a union area which...

CVE-2026-74563

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: hold the RCU lock across ipv6chkaddr in rdstcpladdrcheck rdstcpladdrcheck looks up a scoped IPv6 interface with devgetbyindexrcu, drops the RCU read-side lock, and only then passes the bare struct netdevice into...

CVE-2026-74528

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...

UBUNTU-CVE-2026-74455

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...

CVE-2026-74522

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode. ksmbdclosefd currently marks the file closed a...

UBUNTU-CVE-2026-74529

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectpasync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

EUVD-2026-59638

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE armvsmmuvsidtosid maps a guest's vSID to a single physical Stream ID taken from master-streams0, assuming a device has exactly one stream. A device with sever...

CVE-2026-74570

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfsrlrealloc and ntfsrlreallocnofail...

CVE-2026-74564 netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH

In the Linux kernel, the following vulnerability has been resolved: netfilter: xthashlimit: validate hashtable supports XTHASHLIMITRATEMATCH The XTHASHLIMITRATEMATCH flag mode changes the semantics of the dsthashent structure which represents an entry in the hashtable. There is a union area which...

CVE-2026-74564

CVE-2026-74564 concerns Linux kernel netfilter xt_hashlimit, where the XT_HASHLIMIT_RATE_MATCH flag can cause uninitialized access to the burst field in the dsthash_ent union when two or more rules reference the same hashtable. A kernel fix updates the .checkentry path to require the RATE_MATCH m...

CVE-2026-74528

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...

CVE-2026-74522 ksmbd: fix use-after-free in __close_file_table_ids()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode. ksmbdclosefd currently marks the file closed a...

CVE-2026-74513

CVE-2026-74513 affects the Linux kernel where a use-after-free can occur in dibs loopback handling due to a race between hash-table lookup and refcount teardown of dmb_node. The fix makes hash table membership and refcount transitions atomic: final refcount_dec_and_test() and hash_del() are perfo...

CVE-2026-74512

In the Linux kernel, the following vulnerability has been resolved: audit: fix potential use-after-free in auditdelrule auditdelrule destroys e-rule.exe via auditremovemarkrule before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in auditfilte...

CVE-2026-74506

In the Linux kernel, the following vulnerability has been resolved: afs: Fix UAF when sending a message In afsmakecall, there's a race with async call reception and destruction. If a call is dispatched that doesn't have call-writeiter set used to specify the data content for FS.StoreData, then th...

CVE-2026-74485

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: reject a flag character as the field delimiter The registration string starts with a user chosen delimiter that separates the individual fields. So that the field parsers terminate even on a truncated string createent...

CVE-2026-74474

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull for transmit path header pulls In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the availability of network layer headers ARP, IPv6/ND, IP/IPv6 MDB keys...

EUVD-2026-59667

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull for transmit path header pulls In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the availability of network layer headers ARP, IPv6/ND, IP/IPv6 MDB keys...

CVE-2026-74473

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull in routeshortcircuit routeshortcircuit currently calls pskbmaypullskb, sizeofstruct iphdr or ipv6hdr, which checks if bytes are available starting from skb-data. However, in vxlanxmit, skb-data point...