PT-2026-72681

In the Linux kernel, the following vulnerability has been resolved: net: serialize netif running check in enqueue to backlog Syzbot reported a KASAN slab-use-after-free in fib rules lookup. The root cause is a race condition where packets can escape the backlog flushing during device unregistrati...

PT-2026-72791

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix RB-tree corruption in probe error path The info-node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the device rbtree insert call is skipped. If a subsequent probe step fails, th...

PT-2026-72299

In the Linux kernel, the following vulnerability has been resolved: bpf,fork: wipe -bpf storage before bailouts that access it Currently, copy process can bail out to free task before p-bpf storage has been initialized, with this call graph shown here for the !CONFIG MEMCG case: copy process dup...

PT-2026-72261

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadata dst on RX SC delete When an offloaded MACsec RX SC is deleted, macsec del rxsc ctx freed the per-SC metadata dst with metadata dst free, which kfrees the object unconditionally an...

PT-2026-72423

In the Linux kernel, the following vulnerability has been resolved: batman-adv: retrieve ethhdr after potential skb realloc on RX pskb may pull in batadv interface rx could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

PT-2026-72780

In the Linux kernel, the following vulnerability has been resolved: bpf: Clear rb node linkage when freeing bpf rb root bpf rb root free detaches the root by copying the current rb root cached and then replacing the live root with RB ROOT CACHED. It then walks the copied root and drops each objec...

PT-2026-72992

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix UAF in l2cap le connect rsp l2cap le connect rsp obtains a channel via l2cap get chan by ident but neither holds a reference nor uses l2cap chan hold unless zero before locking and operating on it. A...

Linux Distros Unpatched Vulnerability : CVE-2026-74436

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rxrpc: serialize kernel accept preallocation with socket teardown rxrpckernelchargeaccept reads rx-backlog without any socket/backlog synchronization and passes...

Linux Distros Unpatched Vulnerability : CVE-2026-72337

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: 6lowpan: avoid untracked enable work lowpanenableset allocates a temporary work item and schedules doenableset on systemwq, then returns to debugfs...

PT-2026-72993

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: clear iso data always when detaching conn from hcon When setting conn-hcon = NULL, also conn-hcon-iso data = NULL is necessary, otherwise later iso conn free will UAF. Fix clearing of iso data in iso sock disconn...

PT-2026-73000

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix UAF of txrx stats in nv remove nv remove frees the per-CPU txrx stats before unregister netdev. Until unregister completes, ndo get stats64, the NAPI/xmit data path, and nv close/drain may still access txrx stats,...

PT-2026-72302

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing device refcount for CAN filter removal sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6...

PT-2026-72787

In the Linux kernel, the following vulnerability has been resolved: ocfs2: rebase copied fsdlm LVB pointers in locking state The locking state debugfs iterator snapshots struct ocfs2 lock res by value under ocfs2 dlm tracking lock and later formats that copy in ocfs2 dlm seq show. That is fine fo...

PT-2026-72795

In the Linux kernel, the following vulnerability has been resolved: configfs lookup: don't leave -s dentry dangling on failure Normally -s dentry is cleared when dentry it's pointing to becomes negative on eviction, realistically. However, that only happens if dentry gets to be positive in the...

PT-2026-72823

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with event input event process midi borrows msynth-output rfile.output and then passes the substream to dump midi and snd rawmidi kernel write without synchronizing with the output...

PT-2026-72510

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary...

PT-2026-72749

In the Linux kernel, the following vulnerability has been resolved: vduse: hold vduse lock across IDR lookup in open path vduse dev open looks up struct vduse dev through the IDR and then acquires dev-lock only after vduse lock has been dropped. This leaves a window where a concurrent VDUSE DESTR...

PT-2026-72640

In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intel crtc put color blobs drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intel crtc prepare cleared state,...

PT-2026-72987

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid deadlocks in iso sock timeout iso sock timeout takes lock sock, so sync disabling the timer while holding that lock may deadlock. iso sock timeout may also run concurrently with iso conn del, which leads to...

PT-2026-72274

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsiback get pend req obtains a command tag and returns a vscsibk pend whose embedded se cmd has only been memset to 0, so its cmd kref is 0; the se cmd i...