CVE-2026-10681 SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot

In Zephyr's userspace dynamic-objects subsystem, threadidxalloc in kernel/userspace/userspace.c allocated a new thread permission index from the global threadidxmap bitmap without holding listslock. On SMP systems, two user-mode threads invoking the kobjectallocKOBJTHREAD syscall concurrently can...

CVE-2026-64248

CVE-2026-64248 affects the Linux kernel on MIPS (Realtek MIPS interAptiv). The issue arises in smp_send_stop() which parks secondary CPUs and marks them offline via set_cpu_online(false) without informing RCU, causing RCU to still expect a quiescent state. This can lead to a stall when irq_work_s...

CVE-2026-10667 SMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object tracking, reachable from unprivileged user threads

Zephyr's dynamic kernel-object tracking kernel/userspace/userspace.c, formerly kernel/userspace.c maintains a doubly-linked list objlist of dynamically allocated kernel objects. Iteration over this list in kobjectwordlistforeach was performed under listslock using the SAFE iterator which caches t...

CVE-2026-46063

In the Linux kernel, the following vulnerability has been resolved: x86/shstk: Prevent deadlock during shstk sigreturn During sigreturn the shadow stack signal frame is popped. The kernel does this by reading the shadow stack using normal read accesses. When it can't assume the memory is shadow...

CVE-2026-32848

NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodevop within the opencrypto subsystem that allows local attackers to trigger a double-free condition by concurrently issuing CIOCCRYPT operations on the same session identifier on SMP systems. Attackers can exploit...

EUVD-2026-30791

NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodevop within the opencrypto subsystem that allows local attackers to trigger a double-free condition by concurrently issuing CIOCCRYPT operations on the same session identifier on SMP systems. Attackers can exploit...

PT-2026-41713

Name of the Vulnerable Software and Affected Versions NetBSD versions prior to commit ec8451e Description A race condition in the cryptodev op function within the opencrypto subsystem allows local attackers to trigger a double-free condition on SMP Symmetric Multiprocessing systems. This occurs...

CVE-2026-43258 alpha: fix user-space corruption during memory compaction

In the Linux kernel, the following vulnerability has been resolved: alpha: fix user-space corruption during memory compaction Alpha systems can suffer sporadic user-space crashes and heap corruption when memory compaction is enabled. Symptoms include SIGSEGV, glibc allocator failures e.g...

CVE-2026-23025 mm/page_alloc: prevent pcp corruption with SMP=n

In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: prevent pcp corruption with SMP=n The kernel test robot has reported: BUG: spinlock trylock failure on UP on CPU0, kcompactd0/28 lock: 0xffff888807e35ef0, .magic: dead4ead, .owner: kcompactd0/28, .ownercpu: 0 CPU: 0...

CVE-2026-23025

In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: prevent pcp corruption with SMP=n The kernel test robot has reported: BUG: spinlock trylock failure on UP on CPU0, kcompactd0/28 lock: 0xffff888807e35ef0, .magic: dead4ead, .owner: kcompactd0/28, .ownercpu: 0 CPU: 0...

CVE-2026-23025

In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: prevent pcp corruption with SMP=n The kernel test robot has reported: BUG: spinlock trylock failure on UP on CPU0, kcompactd0/28 lock: 0xffff888807e35ef0, .magic: dead4ead, .owner: kcompactd0/28, .ownercpu: 0 CPU: 0...

EUVD-2026-5069

In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: prevent pcp corruption with SMP=n The kernel test robot has reported: BUG: spinlock trylock failure on UP on CPU0, kcompactd0/28 lock: 0xffff888807e35ef0, .magic: dead4ead, .owner: kcompactd0/28, .ownercpu: 0 CPU: 0...

CVE-2026-23025 mm/page_alloc: prevent pcp corruption with SMP=n

In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: prevent pcp corruption with SMP=n The kernel test robot has reported: BUG: spinlock trylock failure on UP on CPU0, kcompactd0/28 lock: 0xffff888807e35ef0, .magic: dead4ead, .owner: kcompactd0/28, .ownercpu: 0 CPU: 0...

CVE-2026-23025

CVE-2026-23025 : In the Linux kernel, drain_page_zone() could corrupt per-CPU pages (pcp) when an interrupt occurs and code path uses spin_lock(&pcp->lock) with SMP=n, because spin_trylock() may fail. The issue enables potential pcp structure corruption. The fix adds local wrappers that conver...

CVE-2025-71115

In the Linux kernel, the following vulnerability has been resolved: um: init cputasks earlier This is currently done in umlfinishsetup, but e.g. with KCOV enabled we'll crash because some init code can call into e.g. memparse, which has coverage annotations, and then the checks in checkkcovmode...

CVE-2025-71115

In the Linux kernel, the following vulnerability has been resolved: um: init cputasks earlier This is currently done in umlfinishsetup, but e.g. with KCOV enabled we'll crash because some init code can call into e.g. memparse, which has coverage annotations, and then the checks in checkkcovmode...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000272)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000272 advisory. An issue was discovered in the Linux kernel before 5.0.4. The 9p filesystem did not protect isizewrite properly, which causes an isizeread infinite loop and denial o...

PT-2026-5528

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.18.0-rc5-00127-ga06157804399 Description The Linux kernel contains a flaw in the mm/page alloc subsystem that can lead to corruption of the per-cpu pages pcp structure when SMP Symmetric Multi-Processing is...

CVE-2025-40174

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix SMP ordering in switchmmirqsoff Stephen noted that it is possible to not have an smpmb between the loadedmm store and the tlbgen load in switchmm, meaning the ordering against flushtlbmmrange goes out the window, and ...

CVE-2025-40174 x86/mm: Fix SMP ordering in switch_mm_irqs_off()

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix SMP ordering in switchmmirqsoff Stephen noted that it is possible to not have an smpmb between the loadedmm store and the tlbgen load in switchmm, meaning the ordering against flushtlbmmrange goes out the window, and ...