Linux Distros Unpatched Vulnerability : CVE-2026-74344

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Clear rb node linkage when freeing bpfrbroot bpfrbrootfree detaches the root by copying the current rbrootcached and then replacing the live root with...

PT-2026-72436

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dst entry is provided to check the skb headroom and to set the iph-frag off field...

PT-2026-72841

In the Linux kernel, the following vulnerability has been resolved: OPP: Fix race between OPP addition and lookup A race exists between dev pm opp add dynamic and dev pm opp find freq exact: CPU0 add CPU1 lookup ------------------------------- ------------------------------ opp add mutex lock lis...

PT-2026-72875

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry device pasid table teardown zeroes the 128-bit scalable-mode context entry with context clear entry while the Present bit is still set. This creates a...

PT-2026-72872

In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpc kernel charge accept reads rx-backlog without any socket/backlog synchronization and passes that raw pointer into rxrpc service prealloc one. A concurrent...

PT-2026-72969

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs Cancel and flush the I/O APIC's delayed EOI handling work during the "pre VM destroy" phase, before vCPUs are destroyed, as processing the EOI broadcast will...

PT-2026-72305

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device removal RX: an RX SETUP update! for an existing op skipped can rx register unconditionally, even when a concurrent NETDEV UNREGISTER had already torn down its registration op-rx reg dev ...

PT-2026-72631

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during snd usb midi v2 create. A later setup failure can still jump to snd usb midi v2 free, which currently frees each endpoint and its...

PT-2026-73021

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack sip: widen NAT rewrite delta to s32 in sip help tcp sip help tcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more...

PT-2026-72525

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpan enable set allocates a temporary work item and schedules do enable set on system wq, then returns to debugfs. The debugfs active operation has ended at that point, but the...

PT-2026-72942

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid use-after-free in poll trace queue dumps TIPC socket tracepoints dump queue state through tipc sk dump. Most queue-dump callsites already serialize that walk under the socket lock or sk-sk lock.slock, but tipc poll...

PT-2026-72312

In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rx op deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 "can: bcm: use call rcu instead of costly synchronize rcu" replaced synchronize rcu in bcm delete rx op with call rcu and introduced the RX N...

PT-2026-72863

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls a...

PT-2026-72524

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control get l2cap conn looks up an LE hci conn under hdev protection, but then drops that protection before reading hcon-l2cap data and before lowpan control write later...

PT-2026-72932

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to July 2026 Red Hat Enterprise Linux 10.2 Description A use-after-free issue exists in the net bridge component of the Linux kernel. The problem occurs in the br multicast leave group function during the fast-leave...

PT-2026-72269

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix use-after-free during unmount During unmount or failure teardown all mon data structures that contain monitoring event file private data are freed after which kernfs nodes are removed. However, the RDT DELETED fla...

PT-2026-72168

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect ueagle-atm uses the asynchronous request firmware nowait in .probe, but does not wait for its completion, not even in .disconnect; so, if the device is unplugged...

PT-2026-72408

In the Linux kernel, the following vulnerability has been resolved: sunrpc: harden rq procinfo lifecycle to prevent double-free The svc release rqst function executes the callback inside rqstp-rq procinfo-pc release. However, if a worker thread begins processing a new request and encounters an...

PT-2026-72680

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in same client has lease same client has lease returns an opinfo pointer from ci-m op list after dropping ci-m lock without taking a reference. smb grant oplock then dereferences that pointer in copy lea...

PT-2026-72746

In the Linux kernel, the following vulnerability has been resolved: vhost/net: complete zerocopy ubufs only once vhost-net initializes one ubuf info per outstanding zerocopy TX descriptor and hands it to the backend socket. The networking stack may then clone a zerocopy skb before all skb...