CVE-2026-74427 afs: Fix netns teardown to cancel the preallocation charger

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls a...

CVE-2026-74427 afs: Fix netns teardown to cancel the preallocation charger

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls a...

CVE-2026-74427

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls a...

EUVD-2026-59574

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls a...

EUVD-2026-59554

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery SSR. The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed...

CVE-2026-74407

In the Linux kernel, CVE-2026-74407 impacts PCI/MHI-based ath11k WLAN: during shutdown, SSR (WLAN firmware crash recovery) can race with teardown, leading to a NULL pointer dereference in the MHI teardown path while freeing DMA-backed contexts. The fix is to cancel SSR-related work items during P...

CVE-2026-72434 netfilter: ipset: make sure gc is properly stopped

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, canceldelayedworksync was called while gc calls queuedelayedwork unconditionally which can lead not to properly shutting down the gc...

CVE-2026-72071 tracing/user_events: Fix use-after-free in user_event_mm_dup()

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Fix use-after-free in usereventmmdup usereventmmdup walks the parent mm's enabler list locklessly under rcureadlock during fork from copyprocess; it does not take eventmutex: rcureadlock;...

CVE-2026-72036 net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

In the Linux kernel, the following vulnerability has been resolved: net/sched: schmultiq: Replace direct dequeue call with peek and qdiscdequeuepeeked multiqdequeue takes a packet from a band's child with a direct -dequeue call after multiqpeek peeked it. When the child is non-work-conserving the...

PT-2026-72873

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the uvcvideo module when a UVC camera utilizes an asynchronous control. The issue arises when the uvc status stop function is called from async ctrl.work through the...

PT-2026-72767

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A recursive locking deadlock can occur in the firmware loader's power management notification handler. During system suspend or hibernation preparation, the fw pm notify function calls...

PT-2026-72781

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/siw component regarding endpoint and socket association handling. Disassociating a socket from an endpoint using the siw socket disassoc function may release...

PT-2026-72563

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the AFS component where the afs vnode::lock work variable is not sufficiently initialized. Initializing it only once within the slab's init function is inadequate for...

PT-2026-72599

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: fix use-after-free of DSA ports in crc err work Upon an MDIO CRC error mxl862xx crc err work fn walks the DSA ports and closes the CPU port conduits: dsa switch for each cpu portdp, priv-ds dev closedp-conduit...

PT-2026-72622

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter ipset component where the garbage collection gc process may not shut down properly. This occurs because cancel delayed work sync is called during the...

PT-2026-72510

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition occurs between device teardown and incoming Multicast Listener Discovery MLD query processing. During device destruction, the primary reference to inet6 dev is dropped,...

PT-2026-72225

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the multiq dequeue function where a packet is retrieved from a band's child using a direct -dequeue call following a multiq peek operation. In cases where the child is...

PT-2026-72260

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the user event mm dup function within the tracing/user events component. The problem occurs during a fork operation when the function iterates through th...

PT-2026-73027

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the thunderbolt component. The function tb xdp handle request runs on the system workqueue and queues xd-state work via queue delayed work during specifi...

PT-2026-72961

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free UAF issue exists in the Bluetooth subsystem. The function hci find adv instance returns an adv info pointer that is only valid while hdev-lock is held. However,...