EUVD-2026-48782

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adfdisablesriov The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state struct adfaccelvfinfo. Currently, adfdisablesriov destroys per-VF...

CVE-2026-64436

In the Linux kernel, the following vulnerability has been resolved: net: afkey: initialize algkeylen for IPComp states pfkeymsg2xfrmstate handles the IPComp SADBXSATYPEIPCOMP case by allocating x-calg and copying only the algorithm name: x-calg = kmallocobjx-calg; if !x-calg err = -ENOMEM; goto...

CVE-2026-64436 net: af_key: initialize alg_key_len for IPComp states

In the Linux kernel, the following vulnerability has been resolved: net: afkey: initialize algkeylen for IPComp states pfkeymsg2xfrmstate handles the IPComp SADBXSATYPEIPCOMP case by allocating x-calg and copying only the algorithm name: x-calg = kmallocobjx-calg; if !x-calg err = -ENOMEM; goto...

EUVD-2026-48780

In the Linux kernel, the following vulnerability has been resolved: net: afkey: initialize algkeylen for IPComp states pfkeymsg2xfrmstate handles the IPComp SADBXSATYPEIPCOMP case by allocating x-calg and copying only the algorithm name: x-calg = kmallocobjx-calg; if !x-calg err = -ENOMEM; goto...

CVE-2026-64397 ksmbd: serialize QUERY_DIRECTORY requests per file

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERYDIRECTORY requests per file smb2querydir stores a pointer to its stack-allocated private data in the ksmbdfile readdirdata. Concurrent QUERYDIRECTORY requests using the same file handle can overwrite this...

CVE-2026-64386 smb: client: fix query_info() replay double-free

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix queryinfo replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2queryinfoinit fails before the next send, cleanup retains the previous buffer type and...

CVE-2026-64383

CVE-2026-64383 affects the Linux kernel’s SMB2 client path, specifically the SMB2_flush() replay handling. The issue arises when a replayable flush response is received and a retry fails before a replacement response is stored, causing a second free of the stale buffer due to persistent bookkeepi...

EUVD-2026-48927

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2flush replay SMB2flush keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fails before cifssendrecv stores a replacement...

CVE-2026-64309 crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCOMMIT Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...

CVE-2026-64309

CVE-2026-64309 is a Linux kernel vulnerability in the crypto: ccp (SEV-SNP) subsystem. The SNP_COMMIT ioctl would perform SNP initialization even when the component was previously uninitialized. Since the SNP_COMMIT command is valid in the UNINIT firmware state, this could cause side effects: if ...

CVE-2026-64287

CVE-2026-64287 affects the Linux kernel’s KVM on arm64. The issue stems from flush_hyp_vcpu() copying host vgic_v3 state to the hyp’s vCPU and not enforcing the expected bound on list registers, which can lead to out-of-bounds access to ICH_LR_EL2 when host values exceed the number of implemented...

CVE-2026-64287 KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound usedlrs when flushing the pKVM hyp vCPU flushhypvcpu copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use usedlrs as their loop bound and expect it to...

EUVD-2026-48999

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound usedlrs when flushing the pKVM hyp vCPU flushhypvcpu copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use usedlrs as their loop bound and expect it to...

CVE-2026-64258 fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

CVE-2026-64258 fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

EUVD-2026-48970

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

CVE-2026-64258

CVE-2026-64258 — Linux kernel (fuse-uring) : A NULL pointer dereference could occur in the fuse_uring path when a copy to the userspace ring buffer fails. The root cause is that, after fuse_uring_req_end() sets ent->fuse_req to NULL, the ent_w_req_queue entry remained in FRRS_FUSE_REQ, risking...

PT-2026-64695

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vfio mig get next state function where the loop used to skip unsupported optional states does not account for the VFIO DEVICE STATE ERROR sentinel. When a blocked...

PT-2026-64508

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM arm64 component where the flush hyp vcpu function copies the host vGIC state into the hyp's private vCPU without validating the used lrs value. Because used lr...

Linux Distros Unpatched Vulnerability : CVE-2026-64450

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATEMSG can carry a Gap ACK blocks record in its data area. tipcgetgapackblks on...