CVE-2026-64060 netfs: Fix leak of request in netfs_write_begin() error handling

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix leak of request in netfswritebegin error handling Fix netfswritebegin to not leak our ref on the request in the event that we get an error from netfswaitforread...

CVE-2026-64059 netfs: Fix folio->private handling in netfs_perform_write()

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio-private handling in netfsperformwrite Under some circumstances, netfsperformwrite doesn't correctly manipulate folio-private between NULL, NETFSFOLIOCOPYTOCACHE, pointing to a group and pointing to a netfsfolio...

CVE-2026-64059

The CVE affects the Linux kernel netfs code, specifically netfs_perform_write(), where folio->private was not reliably managed across NULL, NETFS_FOLIO_COPY_TO_CACHE, and netfs_folio/group pointers. This could lead to multiple attachments of private data, folio ref leaks, and leaks of netfs_fo...

EUVD-2026-45632

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio-private handling in netfsperformwrite Under some circumstances, netfsperformwrite doesn't correctly manipulate folio-private between NULL, NETFSFOLIOCOPYTOCACHE, pointing to a group and pointing to a netfsfolio...

CVE-2026-64059

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio-private handling in netfsperformwrite Under some circumstances, netfsperformwrite doesn't correctly manipulate folio-private between NULL, NETFSFOLIOCOPYTOCACHE, pointing to a group and pointing to a netfsfolio...

CVE-2026-64059 netfs: Fix folio->private handling in netfs_perform_write()

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio-private handling in netfsperformwrite Under some circumstances, netfsperformwrite doesn't correctly manipulate folio-private between NULL, NETFSFOLIOCOPYTOCACHE, pointing to a group and pointing to a netfsfolio...

CVE-2026-64057 afs: Fix the locking used by afs_get_link()

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the locking used by afsgetlink The afs filesystem in the kernel doesn't do locking correctly for symbolic links. There are a number of problems: 1 It doesn't do any locking around afsreadsingle to prevent races between...

CVE-2026-64029

The provided reports describe a Linux kernel vulnerability in ALSA seq: UMP output teardown where seq_ump_process_event() borrows client->out_rfile.output without proper synchronization, allowing a rawmidi substream to be torn down while an event_input callback is active. The fix, as documente...

CVE-2026-64029 ALSA: seq: Serialize UMP output teardown with event_input

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with eventinput sequmpprocessevent borrows client-outrfile.output without synchronizing with the first-open and last-close transition in sequmpclientopen and sequmpclientclose. The last...

EUVD-2026-45602

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with eventinput sequmpprocessevent borrows client-outrfile.output without synchronizing with the first-open and last-close transition in sequmpclientopen and sequmpclientclose. The last...

CVE-2026-64029 ALSA: seq: Serialize UMP output teardown with event_input

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with eventinput sequmpprocessevent borrows client-outrfile.output without synchronizing with the first-open and last-close transition in sequmpclientopen and sequmpclientclose. The last...

CVE-2026-64009

The CVE-2026-64009 family affects the Linux kernel xfrm subsystem, specifically an out-of-bounds write in ESP handling due to an underflow in xfrm_state_mtu(). The function computes using unsigned arithmetic: it subtracts attacker-influenced header_len + authsize + net_adj from a small mtu, allow...

CVE-2026-64009

In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrmstatemtu Leo Lin reported OOB write issue in esp component: xfrmstatemtu returns u32 but performs its arithmetic in unsigned modulo-2^32 space using an attacker-influenced "headerlen + authsize +...

CVE-2026-64001 ALSA: pcm: oss: Fix setup list UAF on proc write error

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix setup list UAF on proc write error sndpcmossprocwrite links a newly allocated setup entry into the OSS setup list before duplicating the task name. If the task-name allocation fails, the error path frees the...

CVE-2026-64001

Vulnerability: CVE-2026-64001 in the Linux kernel’s ALSA: pcm: oss path. The bug arises in snd_pcm_oss_proc_write() where a newly allocated setup entry is linked into the OSS setup_list before the task-name is safely duplicated; if the task-name allocation fails, the error path frees the linked e...

CVE-2026-64001

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix setup list UAF on proc write error sndpcmossprocwrite links a newly allocated setup entry into the OSS setup list before duplicating the task name. If the task-name allocation fails, the error path frees the...

CVE-2026-63994

The CVE-2026-63994 issue affects the Linux kernel's tunnels code: iptunnel_pmtud_build_icmp(v6) and iptunnel_pmtud_build_icmp() cached ip_hdr()/ipv6_hdr() before skb_cow(), which could reallocate skb->head and cause use-after-free. The patch fixes this by initializing local variables after the...

CVE-2026-63994 tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skbcow in iptunnelpmtudbuildicmpv6 Sashiko found that iptunnelpmtudbuildicmp and iptunnelpmtudbuildicmpv6 were caching iphdr and ipv6hdr before an skbcow call which can reallocate skb-head. Fix...

EUVD-2026-45742

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in rt6fillnode Sashiko reported this issue 1. Apply the same fix as commit f8d8ce1b515a "ipv6: fix possible infinite loop in fib6infousesdev". Writers holding tb6lock can listdelrcu&rt-fib6sibling...

CVE-2026-63952 memfd: deny writeable mappings when implying SEAL_WRITE

In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEALWRITE When SEALEXEC is added, SEALWRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means...