UBUNTU-CVE-2026-74543

In the Linux kernel, the following vulnerability has been resolved: net: udptunnel: fix memory leak in udptunnelnicunregister syzbot reported a memory leak 1 in the UDP tunnel NIC offload code. When device registration fails e.g. in registernetdevice, netdev core unwinds by sending a single...

EUVD-2026-59741

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix UAF of txrxstats in nvremove nvremove frees the per-CPU txrxstats before unregisternetdev. Until unregister completes, ndogetstats64, the NAPI/xmit data path, and nvclose/drain may still access txrxstats, leading t...

CVE-2026-74543 net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()

In the Linux kernel, the following vulnerability has been resolved: net: udptunnel: fix memory leak in udptunnelnicunregister syzbot reported a memory leak 1 in the UDP tunnel NIC offload code. When device registration fails e.g. in registernetdevice, netdev core unwinds by sending a single...

CVE-2026-74543

In the Linux kernel, the following vulnerability has been resolved: net: udptunnel: fix memory leak in udptunnelnicunregister syzbot reported a memory leak 1 in the UDP tunnel NIC offload code. When device registration fails e.g. in registernetdevice, netdev core unwinds by sending a single...

EUVD-2026-59736

In the Linux kernel, the following vulnerability has been resolved: net: udptunnel: fix memory leak in udptunnelnicunregister syzbot reported a memory leak 1 in the UDP tunnel NIC offload code. When device registration fails e.g. in registernetdevice, netdev core unwinds by sending a single...

CVE-2026-74513 dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmbnode in loopback attach/detach/unregister dibsloattachdmb, dibslodetachdmb and dibslounregisterdmb look up the dmbnode under dmbhtlock, drop the lock and only then operate on the node's refcount...

CVE-2026-72357

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Use proper mmstruct in inuprobetrampoline In the unregister path we use inuprobetrampoline check with current-mm for the VMA lookup, which is wrong, because we are in the tracer context, not the traced process. Add...

CVE-2026-72125

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix use-after-free race with concurrent NETDEVUNREGISTER isotprelease looked up the bound network device via devgetbyindex using the stored ifindex. During device unregistration the device is unlisted from the ifindex...

CVE-2026-72058

In the Linux kernel, the following vulnerability has been resolved: net: ixp4xxhss: fix duplicate HDLC netdev allocation ixp4xxhssprobe allocates two HDLC netdevs. The first one is stored in ndev, initialized, and registered with registerhdlcdevice. The second one is stored in port-netdev and lat...

CVE-2026-72357 uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Use proper mmstruct in inuprobetrampoline In the unregister path we use inuprobetrampoline check with current-mm for the VMA lookup, which is wrong, because we are in the tracer context, not the traced process. Add...

EUVD-2026-59256

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Use proper mmstruct in inuprobetrampoline In the unregister path we use inuprobetrampoline check with current-mm for the VMA lookup, which is wrong, because we are in the tracer context, not the traced process. Add...

EUVD-2026-59074

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device removal RX: an RXSETUP update! for an existing op skipped canrxregister unconditionally, even when a concurrent NETDEVUNREGISTER had already torn down its registration op-rxregdev == NUL...

CVE-2026-72115

The CVE-2026-72115 issue affects the Linux kernel CAN BCM RX path. A race between bcm_rx_handler(), hrtimer_cancel(), bcm_rx_starttimer(), and bcm_rx_timeout_handler() could allow an ANYDEV operation (ifindex == 0) to process frames from multiple interfaces, causing spurious RX_TIMEOUT events and...

PT-2026-72995

In the Linux kernel, the following vulnerability has been resolved: net: udp tunnel: fix memory leak in udp tunnel nic unregister syzbot reported a memory leak 1 in the UDP tunnel NIC offload code. When device registration fails e.g. in register netdevice, netdev core unwinds by sending a single...

PT-2026-72314

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix use-after-free race with concurrent NETDEV UNREGISTER isotp release looked up the bound network device via dev get by index using the stored ifindex. During device unregistration the device is unlisted from the...

PT-2026-73000

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix UAF of txrx stats in nv remove nv remove frees the per-CPU txrx stats before unregister netdev. Until unregister completes, ndo get stats64, the NAPI/xmit data path, and nv close/drain may still access txrx stats,...

PT-2026-72201

In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Call synchronize rcu when unregistering This ensures that any RCU readers traversing the instance list have finished, before releasing the reference on the tracer that the instance points to...

PT-2026-72545

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Use proper mm struct in in uprobe trampoline In the unregister path we use in uprobe trampoline check with current-mm for the VMA lookup, which is wrong, because we are in the tracer context, not the traced process...

PT-2026-72965

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmb node in loopback attach/detach/unregister dibs lo attach dmb, dibs lo detach dmb and dibs lo unregister dmb look up the dmb node under dmb ht lock, drop the lock and only then operate on the node's...

CVE-2026-68414

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work on unregister cfg80211schedscanresults can queue rdev-schedscanreswk from a driver result notification while a scheduled scan request is present. The work callback recovers the...