PT-2026-72259

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas tf: fix use-after-free in lbtf free adapter lbtf free adapter calls timer delete&priv-command timer, which does not wait for a running command timer fn callback. lbtf free adapter runs on the teardown path right...

PT-2026-72788

In the Linux kernel, the following vulnerability has been resolved: of: reserved mem: avoid post-init UAF when alloc reserved mem array fails The global pointer 'reserved mem' continues to reference the reserved mem array which lives in initdata if alloc reserved mem array fails. of reserved mem...

PT-2026-72282

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix use-after-free in amdxdna gem dmabuf mmap When vm insert pages fails, the error path calls vma-vm ops-closevma which internally calls drm gem vm close → drm gem object put, releasing the GEM object reference...

PT-2026-72542

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfs write mft block maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlist element under ni-runlist.lock, drops the...

PT-2026-72688

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt re: Free SRQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt qplib destroy srq won't write the toggle values to an already-fre...

PT-2026-72231

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmi alloc recv msguser takes the temporary user reference owned by the receive message, and ipmi free recv msg drops it again. If event delivery fails after allocating receive...

PT-2026-72765

In the Linux kernel, the following vulnerability has been resolved: watchdog: unregister PM notifier on watchdog unregister watchdog register device registers wdd-pm nb when WDOG NO PING ON SUSPEND is set, but watchdog unregister device does not remove it. This leaves an embedded notifier block o...

PT-2026-72572

In the Linux kernel, the following vulnerability has been resolved: irqchip/ts4800: Fix missing chained handler cleanup on remove The driver installs a chained handler for the parent interrupt during probe using irq set chained handler and data, but the remove function does not clear this handler...

PT-2026-72530

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats agent registration race mlx5e hv vhca stats create registers the stats agent through mlx5 hv vhca agent create. The helper publishes the agent in hv vhca-agentstype under agents lock and immediately...

PT-2026-73020

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Fix race between LPI release and re-registration Fix a potential race between decrementing an LPI's reference count and evicting that structure from the LPI xarray. LPI structures are maintained in the VGIC LPI...

PT-2026-72592

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in cleanup bearer due to premature dst cache destroy TIPC UDP media bearer teardown calls dst cache destroy on its replicast caches before calling synchronize net to wait for concurrent RCU readers transmitters to...

PT-2026-72991

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso sock getname Accessing iso pisk-conn requires lock sock, which is not held here. Fix by adding the lock/release...

PT-2026-72577

In the Linux kernel, the following vulnerability has been resolved: bridge: stp: Fix a potential use-after-free when deleting a bridge The three STP timers are not supposed to be armed while the bridge is administratively down. They are synchronously deactivated when the bridge is put...

PT-2026-72541

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in fallocate ntfs attr fallocate allocates holes and delayed allocations inside initialized size by looking up the current runlist element under ni-runlist.lock. The returned struct...

PT-2026-72571

In the Linux kernel, the following vulnerability has been resolved: sctp: fix addr wq timer race in sctp free addr wq sctp free addr wq previously removed addr wq timer using timer delete while holding addr wq lock. However, timer delete does not guarantee that a currently running timer handler h...

Linux Distros Unpatched Vulnerability : CVE-2026-72472

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfs: use nfsi-rwsem to protect traversal of the file lock list Lingfeng identified a bug and suggested two solutions, but both appear to have issues. Generally,...

Linux Distros Unpatched Vulnerability : CVE-2026-72070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: libertastf: fix use-after-free in lbtffreeadapter lbtffreeadapter calls timerdelete&priv-commandtimer, which does not wait for a running commandtimerfn...

Linux Distros Unpatched Vulnerability : CVE-2026-74505

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: 6fire: Fix UAF at error handling during probe Although 6fire driver had a few fixes for dealing with the early error handling during the probe phase, it...

Linux Distros Unpatched Vulnerability : CVE-2026-74401

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dlm: fix add msg handle in sendqueue ordered In a benchmark scenario triggering a lot of requests that triggers a lot of DLM messages on the network it can be...

Linux Distros Unpatched Vulnerability : CVE-2026-74496

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fou: Fix use-after-free in foucreate foucreate publishes struct fou through skuserdata before adding the new FOU port to the per-netns list. If fouaddtoportlist...