CVE-2026-74427 afs: Fix netns teardown to cancel the preallocation charger

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls a...

CVE-2026-74427 afs: Fix netns teardown to cancel the preallocation charger

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls a...

CVE-2026-74427

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls a...

EUVD-2026-59574

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls a...

CVE-2026-74407

In the Linux kernel, CVE-2026-74407 impacts PCI/MHI-based ath11k WLAN: during shutdown, SSR (WLAN firmware crash recovery) can race with teardown, leading to a NULL pointer dereference in the MHI teardown path while freeing DMA-backed contexts. The fix is to cancel SSR-related work items during P...

EUVD-2026-59554

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery SSR. The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed...

CVE-2026-72434 netfilter: ipset: make sure gc is properly stopped

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, canceldelayedworksync was called while gc calls queuedelayedwork unconditionally which can lead not to properly shutting down the gc...

CVE-2026-72071 tracing/user_events: Fix use-after-free in user_event_mm_dup()

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Fix use-after-free in usereventmmdup usereventmmdup walks the parent mm's enabler list locklessly under rcureadlock during fork from copyprocess; it does not take eventmutex: rcureadlock;...

CVE-2026-72036 net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

In the Linux kernel, the following vulnerability has been resolved: net/sched: schmultiq: Replace direct dequeue call with peek and qdiscdequeuepeeked multiqdequeue takes a packet from a band's child with a direct -dequeue call after multiqpeek peeked it. When the child is non-work-conserving the...

CVE-2026-72005 wifi: rt2x00: avoid full teardown before work setup in probe

In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00libprobedev uses the full rt2x00libremovedev teardown for all probe failures. However, drvdata allocation and workqueue allocation can fail before intfwork,...

PT-2026-72510

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition occurs between device teardown and incoming Multicast Listener Discovery MLD query processing. During device destruction, the primary reference to inet6 dev is dropped,...

PT-2026-72767

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A recursive locking deadlock can occur in the firmware loader's power management notification handler. During system suspend or hibernation preparation, the fw pm notify function calls...

PT-2026-72961

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free UAF issue exists in the Bluetooth subsystem. The function hci find adv instance returns an adv info pointer that is only valid while hdev-lock is held. However,...

CVE-2026-72322: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary...

CVE-2026-72005: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00libprobedev uses the full rt2x00libremovedev teardown for all probe failures. However, drvdata allocation and workqueue allocation can fail before intfwork,...

PT-2026-72225

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the multiq dequeue function where a packet is retrieved from a band's child using a direct -dequeue call following a multiq peek operation. In cases where the child is...

PT-2026-72599

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: fix use-after-free of DSA ports in crc err work Upon an MDIO CRC error mxl862xx crc err work fn walks the DSA ports and closes the CPU port conduits: dsa switch for each cpu portdp, priv-ds dev closedp-conduit...

PT-2026-72260

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the user event mm dup function within the tracing/user events component. The problem occurs during a fork operation when the function iterates through th...

PT-2026-72563

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the AFS component where the afs vnode::lock work variable is not sufficiently initialized. Initializing it only once within the slab's init function is inadequate for...

PT-2026-72873

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the uvcvideo module when a UVC camera utilizes an asynchronous control. The issue arises when the uvc status stop function is called from async ctrl.work through the...