Linux Distros Unpatched Vulnerability : CVE-2026-74540

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: fix UAF in l2capleconnectrsp l2capleconnectrsp obtains a channel via l2capgetchanbyident but neither holds a reference nor uses...

Linux Distros Unpatched Vulnerability : CVE-2026-72085

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded sec...

Linux Distros Unpatched Vulnerability : CVE-2026-74528

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...

Linux Distros Unpatched Vulnerability : CVE-2026-74302

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcicore: Fix UAF in hciunregisterdev hciunregisterdev does not disable cmdtimer and ncmdtimer before the hcidev structure is freed. If a timeout fire...

PT-2026-72327

In the Linux kernel, the following vulnerability has been resolved: tcp: defer md5sig info kfree past RCU grace period in tcp connect The md5+ao reconciliation in tcp connect net/ipv4/tcp output.c has two symmetric branches: if needs md5 tcp ao destroy socksk, false; else if needs ao tcp clear md...

PT-2026-72766

In the Linux kernel, the following vulnerability has been resolved: configfs: fix lockless traversals of -s children Having the parent directory locked protects entries from removal by another thread, but it does not protect cursors from being moved around by lseek - or freed, for that matter...

PT-2026-72764

In the Linux kernel, the following vulnerability has been resolved: iommufd: Destroy the pages content after detaching from dmabuf Sashiko points out this has gotten out of order, the mutex could still be in use through the dmabuf invalidation callbacks. Don't destroy any of the pages content unt...

PT-2026-72955

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRV TIMER IFLG DEAD once the close completes snd timer close locked marks an instance with SNDRV TIMER IFLG DEAD and returns early when the flag is already set, but the flag is never cleared again. A complete...

PT-2026-72272

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core scsi3 emulate pro register and move maps the PERSISTENT RESERVE OUT parameter list with transport kmap data sg and parses the destination TransportID wit...

PT-2026-72523

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hci add adv monitor publishes a new adv monitor in hdev-adv monitors idr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...

PT-2026-72923

In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of register event in trace module add events trace module add events ignores the return value of register event and unconditionally calls add event to tracers for each event. If register event fails fo...

PT-2026-72581

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: don't cache shinfo across skb realloc fbnic tx lso calls skb cow head which may reallocate the skb including the shared info. We can't use the pointer calculated before the call. BUG: KASAN: slab-use-after-free in fbn...

PT-2026-72964

In the Linux kernel, the following vulnerability has been resolved: audit: fix potential use-after-free in audit del rule audit del rule destroys e-rule.exe via audit remove mark rule before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in aud...

PT-2026-72869

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix UAF in rxgk issue challenge Fix rxgk issue challenge to free the page containing the challenge content after invoking the tracepoint as the whdr passed to the tracepoint points into the page just freed...

PT-2026-72660

In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi-rwsem to protect traversal of the file lock list Lingfeng identified a bug and suggested two solutions, but both appear to have issues. Generally, we cannot release flc lock while iterating over the file lock list t...

PT-2026-72957

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the ALSA 6fire driver. The driver fails to handle a pending USB Request Block URB—a data structure used to manage USB communication—during the error...

PT-2026-72268

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix use-after-free and double-free in disconnect ims pcu disconnect only intended to perform cleanup when the primary control interface is unbound. However, it currently relies on the interface class to distingui...

PT-2026-72786

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate fast symlink target during inode read ocfs2 validate inode block already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same...

PT-2026-72487

In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tracepoints tipc sk enqueue runs with sk-sk lock.slock held while the socket is owned by user context. The spinlock protects the backlog queue in this path, but it does not serialize...

PT-2026-72974

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in close file table ids A ksmbd file can remain alive after logical close while another session holds a temporary reference obtained through ksmbd lookup fd inode. ksmbd close fd currently marks the file...