CVE-2026-64375

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second...

CVE-2026-64371

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess: -...

CVE-2026-64371

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess: -...

CVE-2026-64389

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbdauthntlmv2 derives the NTLMv2 session key into sess-sesskey before it verifies the NTLMv2 response. ksmbddecodentlmsspauthblob then continues into KEYXCH even when...

UBUNTU-CVE-2026-64423

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64419

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: do not hold RCU lock in shrinkerdebugfscountshow Reading the debugfs "count" file of a memcg-aware shrinker can sleep inside an RCU read-side critical section: BUG: sleeping function called from invalid context at...

UBUNTU-CVE-2026-64419

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: do not hold RCU lock in shrinkerdebugfscountshow Reading the debugfs "count" file of a memcg-aware shrinker can sleep inside an RCU read-side critical section: BUG: sleeping function called from invalid context at...

UBUNTU-CVE-2026-64388

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership chown and group chgrp modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFSMOUNTCIFSACL or CIFSMOUNTMODEFROMSID were also explicitly...

UBUNTU-CVE-2026-64371

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess: -...

UBUNTU-CVE-2026-64375

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second...

UBUNTU-CVE-2026-64352

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...

UBUNTU-CVE-2026-64443

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in updatebeaconinfo IE loop The IE parsing loop in updatebeaconinfo advances by pIE-length + 2 each iteration but only guards on i length from one byte past the allocated receive buffer...

UBUNTU-CVE-2026-64442

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issueassocreq and joincmdhdl Two IE parsing loops are missing the header bounds checks before they dereference pIE-length: - issueassocreq walks pmlmeinfo-network.ies to build the...

RHSA-2026:0921 Red Hat Security Advisory: go-toolset:rhel8 security update

Bulletin has no description...

EUVD-2026-49037

In the Linux kernel, the following vulnerability has been resolved: xfrm: move policybydst RCU sync from per-netns .exit to .preexit The struct pernetoperations docstring in include/net/netnamespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking...

CVE-2026-64525

In the Linux kernel, the following vulnerability has been resolved: xfrm: move policybydst RCU sync from per-netns .exit to .preexit The struct pernetoperations docstring in include/net/netnamespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking...

CVE-2026-64525 xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit

In the Linux kernel, the following vulnerability has been resolved: xfrm: move policybydst RCU sync from per-netns .exit to .preexit The struct pernetoperations docstring in include/net/netnamespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking...

CVE-2026-64525

In the Linux kernel, the following vulnerability has been resolved: xfrm: move policybydst RCU sync from per-netns .exit to .preexit The struct pernetoperations docstring in include/net/netnamespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking...

CVE-2026-64513 KVM: x86: Unconditionally recompute CR8 intercept on PPR update

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Unconditionally recompute CR8 intercept on PPR update The TPRTHRESHOLD field in the VMCS is used by VMX to induce VM exits when the guest's virtual TPR falls under the specified threshold, allowing KVM to inject...

CVE-2026-64513

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Unconditionally recompute CR8 intercept on PPR update The TPRTHRESHOLD field in the VMCS is used by VMX to induce VM exits when the guest's virtual TPR falls under the specified threshold, allowing KVM to inject...