The vulnerability of the mgmt_index_removed() function in the net/bluetooth/mgmt.c module of the Linux kernel’s Bluetooth subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the mgmtindexremoved function in the net/bluetooth/mgmt.c module of the Linux kernel’s Bluetooth subsystem is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

PT-2026-65047

OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted HMAC'd. This impacts those using the ACME functionality of PKI, resulting in...

CVE-2026-64243

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: simple-mux: Fix enum control bounds check simplemuxcontrolput rejects values greater than e-items, but enum control values are zero based. For the two-entry mux used by this driver, valid values are 0 and 1, so valu...

The vulnerability of the hci_sockbind() function in the net/bluetooth/hci_sock.c module of the Linux kernel’s Bluetooth subsystem allows a malicious actor to escalate their privileges or cause service failures.

The vulnerability of the hcisockbind function in the net/bluetooth/hcisock.c module of the Linux kernel’s Bluetooth subsystem is related to the reallocation of previously freed memory. Exploiting this vulnerability can allow an attacker to gain increased privileges or cause service failures...

libssh2 Heap Out-of-Bounds Read via publickey subsystem

...

drivers/base/memory: set mem->altmap after successful device registration

...

SUSE CVE-2026-64421

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix use-after-free on remove KASAN reports a slab-use-after-free in mediaentityremovelink during rmmod of imx8isi: BUG: KASAN: slab-use-after-free in mediaentityremovelink+0x608/0x650 Read of size 2 at addr...

SUSE CVE-2026-64503

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxsd9: fix runtime PM imbalance on writeraw error kxsd9writeraw takes a runtime PM reference with pmruntimegetsync but returns -EINVAL directly when a scale with a non-zero integer part is requested, skipping the...

CVE-2026-66034

A missing bounds check in the libssh2 publickey subsystem allows malicious SSH servers to trigger a client-side out-of-bounds read, leaking heap pointers that could enable security bypasses, denial of service, or code execution. Mitigation To mitigate this, strictly avoid connecting to untrusted...

CVE-2026-64453

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbiodisconnect walks usbio-clilist in reverse and uninitializes each auxiliary device. auxiliarydeviceuninit drops the device reference, and for an unbound child that can r...

CVE-2026-64435

In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skbqueuelen readers on auditqueue Multiple readers access auditqueue.qlen via skbqueuelen without holding the queue lock or using READONCE, while kauditd writes to this field via the skbdequeue → skbunlin...

CVE-2026-64343

In the Linux kernel, the following vulnerability has been resolved: USB: ldusb: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a kr...

CVE-2026-64329

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove The threaded IRQ handler ccgirqhandler calls ucsinotifycommon, which on a connector-change event calls ucsiconnectorchange and schedules connector work. In ucsiccgremove...

AZL-93641 CVE-2026-64294 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were introduced, inode ownership checks for side-channel protection in mincore and madviseMADVPAGEOUT were done against the nopmntidmap, which...

UBUNTU-CVE-2026-64451

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in funcsetflag funcsetflag dereferences tr-currenttraceflags before verifying that the current tracer is actually the function tracer. When the active tracer has been switched away from...

CVE-2026-64266

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fusereffolio fusereffolio unlocks the request but does not re-lock it before returning. fusechanabort can end the request and the async end callback eg fusewritepagefree can free the ar...

CVE-2026-64311

In the Linux kernel, the following vulnerability has been resolved: crypto: loongson - Remove broken and unused loongson-rng The loongson-rng rngalg has several vulnerabilities, including not providing forward security, and a use-after-free bug due to the use of waitforcompletioninterruptible...

UBUNTU-CVE-2026-64341

In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use ...

CVE-2026-64495

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: bmg160: bail out when bandwidth/filter is not in table bmg160getfilter walks bmg160sampfreqtable looking for the entry matching the bwbits value read from the chip: for i = 0; i ARRAYSIZEbmg160sampfreqtable; ++i if...

CVE-2026-64502

CVE-2026-64502 affects the Linux kernel IIO ADC driver (ad_sigma_delta) for devices with has_registers = false and optional rdy_gpiod. The underlying issue was in ad_sigma_delta_clear_pending_event(): reading the status path could consume a pending conversion data, corrupt the stream, and, with n...