CVE-2026-74565

A flaw was found in the Linux kernel's netfilter subsystem. The global nature of the nftobject rhltable allows a local attacker to access objects that are being deallocated by other network namespaces. This can lead to a use-after-free vulnerability, potentially resulting in memory corruption or...

CVE-2026-74538

A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream subsystem. A missing lock when accessing socket connection information within the isoconnectind function could lead to a null pointer dereference. This vulnerability could allow a local attacker to cause a system crash,...

CVE-2026-74529

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI synchronization component. This vulnerability, a Use-After-Free UAF, occurs when a connection object is prematurely released while the hcisync task is still active. A local attacker could potentially exploit this to...

CVE-2026-74508

A flaw was found in the Linux kernel's Bluetooth Human Interface Device Protocol HIDP implementation. A connected HIDP peer can send specially crafted Bluetooth packets that cause the system to read uninitialized memory. This can lead to a denial of service by terminating the HIDP session...

CVE-2026-74499

A flaw was found in the kernel's Advanced Linux Sound Architecture ALSA USB audio driver. An integer overflow vulnerability in the sndusbmidiakaioutput function, when processing data from a USB device with a small bulk-OUT endpoint, can lead to an out-of-bounds write in the kernel heap. A local...

CVE-2026-74475

A flaw was found in the Linux kernel's VXLAN Virtual Extensible LAN implementation. An issue exists where the neighbor hardware address MAC address could be read incorrectly due to a lack of proper synchronization. This could lead to the system using a partially updated or corrupted MAC address,...

CVE-2026-74470

A flaw was found in the scsidebug module of the Linux kernel. This vulnerability occurs in the respreportzones function when handling specific allocation lengths, leading to an integer underflow. On 32-bit systems, this can cause an out-of-bounds write, which results in a kernel panic. A local...

CVE-2026-74464

A flaw was found in the Open vSwitch OVS component of the Linux kernel. This vulnerability occurs when a packet becomes unparseable during a flow key update operation. This can lead to a memory leak, potentially allowing a remote attacker to cause a denial of service by exhausting system resource...

CVE-2026-74440

A flaw was found in the Linux kernel's drm/xe driver. The xeexecioctl function did not properly wait on kernel fences for external Buffer Objects BOs. This oversight allows a local attacker to initiate a user job that races with ongoing kernel memory management operations on external BOs. A...

CVE-2026-72287

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component. A consistency check failure in the nested virtualization nVMX feature, specifically when Extended Page Tables EPT are disabled, allows a malicious first-level L1 guest to operate with its own controlled CR3 Control...

CVE-2026-72248

A flaw was found in the Linux kernel's netfilter flowtable component. When an Internet Protocol over Internet Protocol IPIP tunnel is used with direct transmit xmit, such as with a bridge device, the system fails to properly handle network packet destination entries. This improper handling can le...

CVE-2026-72019

A flaw was found in the macsec component of the Linux kernel. When processing packets on the AFPACKET SOCKRAW + PACKETQDISCBYPASS transmit path, the macsecencrypt function attempts to read an unset Media Access Control MAC header. This leads to a 12-byte heap over-read, where sensitive data from...

CVE-2026-68466

A flaw was found in the Linux kernel's lpc32xxslc driver, which manages NAND flash memory. This vulnerability occurs because the driver fails to properly handle Direct Memory Access DMA transfer timeouts. When a DMA transfer times out, the driver incorrectly reports it as successful and unmaps th...

CVE-2026-68458

A flaw was found in the Linux kernel's binder component. An error in calculating buffer boundaries during transaction processing causes a security context's length to be prematurely cleared, leading to an inflated buffer size. This allows data to be written into an unintended memory region, which...

CVE-2026-68456

A flaw was found in the Linux kernel's ueagle-atm USB driver. This driver uses an asynchronous mechanism for loading firmware but does not wait for its completion when a device is disconnected. This creates a race condition where the device's teardown can run concurrently with firmware loading. I...

CVE-2026-68455

A flaw was found in the Linux kernel's liveupdate component. This vulnerability arises from insufficient validation of session types during ioctl operations. A local user can exploit this by attempting an ioctl operation intended for an incoming session on an outgoing session. This improper...

CVE-2026-68470

A flaw was found in the Linux kernel's mac80211 wifi driver. Improper validation of extension-frame layouts before processing received frames could allow a remote attacker to send specially crafted S1G beacon extension frames. This could lead to incorrect memory access when reading network header...

CVE-2026-74562

A flaw was found in the Linux kernel's nexthop component. A race condition exists where internal lists are walked without proper locking during nexthop replacement and route deletion. A local attacker could exploit this by concurrently manipulating IPv6 routes, leading to a use-after-free...

CVE-2026-74549

A flaw was found in the hwmon hardware monitoring driver for the nct6775-core in the Linux kernel. During initialization, the driver incorrectly accesses memory beyond the allocated buffer when handling certain register arrays. This out-of-bounds read can lead to the use of invalid hardware...

CVE-2026-74528

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a use-after-free, occurs when the hcisync component improperly handles connection references, leading to the potential reuse and access of freed memory pointers. A remote attacker could exploit this to cause system...

CVE-2026-74500

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture USB audio driver, specifically affecting RME Digiface devices. An unprivileged local user could exploit this vulnerability by reading the device status, which, due to an uninitialized buffer, may expose sensitive kernel...

CVE-2026-74456

A flaw was found in the Linux kernel's Controller Area Network CAN Universal Serial Bus USB driver. This vulnerability, a double free, occurs when a USB request block URB submission fails, causing the system to attempt to release the same memory twice. This could allow a local attacker to...

CVE-2026-74445

A flaw was found in the Linux kernel's drm/vmwgfx component. A local attacker can trigger a null pointer dereference by sending a specially crafted command to the vmwcmddxbindquery function. This can lead to a kernel crash, resulting in a Denial of Service DoS for the affected system...

CVE-2026-72445

A flaw was found in the Linux kernel's ALSA USB audio driver for QCOM devices. An attacker, by providing an invalid service interval during stream enablement, can cause the audio substream to become unresponsive. This can lead to a Denial of Service DoS for the affected audio device, requiring a...

CVE-2026-72088

A flaw was found in the Linux kernel's hpsa SCSI driver. When a physical disk is in a reset state, the driver fails to properly unmap Direct Memory Access DMA resources. This oversight can lead to a DMA mapping leak, potentially causing resource exhaustion over time...

CVE-2026-72069

A flaw was found in the Linux kernel. The rtspinunlock function, and similar real-time RT locking mechanisms, incorrectly release Read-Copy-Update RCU protection before fully unlocking, leading to a Use-After-Free UAF vulnerability. This issue could allow a local attacker to potentially cause a...

CVE-2026-73662

A flaw was found in the FreePBX Music on Hold module. An authenticated administrator can exploit dangerous command-line options when configuring media players, such as /usr/bin/mpg123. This allows the administrator to execute arbitrary commands as the asterisk service user by writing files, openi...

CVE-2026-74506

A flaw was found in the Linux kernel's AFS Andrew File System component. A race condition exists in the afsmakecall function during asynchronous call reception and destruction when sending a message. This can lead to a Use-After-Free UAF vulnerability, where memory is improperly accessed after it...

CVE-2026-74491

A flaw was found in the Linux kernel. A null pointer dereference vulnerability exists within the ofpcirangeparserone function. This occurs when ofmatchbus returns a null value for nodes with specific range properties, which is then improperly dereferenced. An attacker could potentially exploit th...

CVE-2026-74471

A flaw was found in the Linux kernel's tracing subsystem. The tracemoduleaddevents function does not properly check the return value of registerevent. If event registration fails, a pointer to an event can still be created and retained even after the associated module memory is freed. This can le...

CVE-2026-72458

A flaw was found in the Linux kernel's Apparmor security module. This vulnerability occurs in the unpackpdb function, where it does not correctly handle a null pointer if a preceding operation, unpackdfa, fails. This oversight can lead to a NULL pointer dereference, which typically results in a...

CVE-2026-72373

A flaw was found in the AFS Andrew File System component of the Linux kernel. A missing NULL pointer check in the afsbreaksomecallbacks function could allow a local attacker to trigger a kernel panic, leading to a denial of service. This occurs when the afslookupvolumercu function returns a NULL...

CVE-2026-74578

A flaw was found in the Linux kernel's algifskcipher cryptographic module. An unprivileged local user could exploit a race condition in the asynchronous I/O AIO path, where a concurrent operation overwrites the Initialization Vector IV used by an in-flight cryptographic request. This IV reuse...

CVE-2026-74494

A flaw was found in ksmbd, a kernel module for SMB3 protocol support. An unauthenticated client can send multiple SMB2 NEGOTIATE requests on a single connection before a session is established. This leads to a memory leak, as previous allocations are not properly freed. Repeated exploitation of...

CVE-2026-72490

A flaw was found in the Linux kernel's rtl8723bs Wi-Fi driver. An incorrect null-pointer guard in the rtwaesdecrypt function could lead to the system misinterpreting memory addresses. This issue may result in a system crash, causing a Denial of Service DoS...

CVE-2026-72296

A flaw was found in the Linux kernel's In-band Flow Engine IFE component. A remote attacker could send a specially crafted IFE frame with a malformed inner Ethernet header. This improper handling of the packet structure could lead to a system crash, resulting in a Denial of Service DoS...

CVE-2026-72189

A flaw was found in the Linux kernel's NTFS file system. During the process of shutting down a file system, a specific internal condition can arise where the system attempts to update an attribute list while an associated inode is being evicted. This can lead to a self-deadlock within the kernel'...

CVE-2026-19999

A buffer overflow in Assimp's ParseBoneTrafoKeys3DGSMDL7 function allows a remote attacker to cause a denial of service or potentially access sensitive information by tricking a user into loading a maliciously crafted 3DGS MDL7 file. Mitigation To mitigate this issue, avoid processing untrusted...

CVE-2026-72470

A flaw was found in the Linux kernel's NTFS3 file system driver. This vulnerability occurs when a user attempts to mount a specially crafted or dirty NTFS volume where the log page size on disk is larger than the buffer initially allocated by the kernel. This mismatch leads to a buffer overflow, ...

CVE-2026-72309

A flaw was found in the Linux kernel's tracing/remotes component. This vulnerability occurs when a page allocation fails within the traceremoteallocbuffer function. Due to an unincremented CPU counter, a partially allocated buffer descriptor rbdesc is not properly freed, leading to a memory leak...

CVE-2026-72011

A flaw was found in the Linux kernel's s390/diag component. A local user could exploit a missing bounds check when handling a user-controlled 'level' variable, which is used to read from an array. This vulnerability could lead to information disclosure through speculative execution, potentially...

CVE-2026-72305

A flaw was found in VDUSE in the Linux kernel. This vulnerability allows a local user to disclose sensitive kernel information. By mapping non-page-aligned bounce pages to userspace, an attacker can access kernel memory that should not be exposed, leading to an information disclosure...

CVE-2026-72310

A flaw was found in the Linux kernel's Server Message Block SMB client. A malicious SMB server could exploit an integer overflow vulnerability in the smb2ioctlqueryinfo function's bounds check. By sending a specially crafted response with a large offset, the server can cause the client to read da...

CVE-2026-72025

A flaw was found in the Linux kernel's s390/monwriter component. This vulnerability allows a malicious local user with elevated privileges to cause memory corruption. By changing the data length during buffer reuse, the monwriter code fails to validate the new length, leading to an out-of-bounds...

CVE-2026-15218

A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code...

CVE-2026-72454

A flaw was found in the Linux kernel's MIPI I3C Host Controller Interface HCI driver. A race condition in the i3chciaddrtodev function allows concurrent device addition or removal operations to modify a device list while it is being traversed without proper locking. This can lead to a...

CVE-2026-72292

A flaw was found in the kernel. A local user could exploit a vulnerability in the KVMS390GETCMMABITS ioctl, specifically within the kvms390getcmmabits function. This function allocates memory without properly initializing all pages, leading to uninitialized memory regions. These uninitialized...

CVE-2026-72220

A flaw was found in the Linux kernel's sunrpc component. When a worker thread processes a new request and encounters an early error, a stale release hook can be re-triggered against previously used data. This can lead to a double-free or use-after-free vulnerability, potentially allowing an...

CVE-2026-68457

A flaw was found in ksmbd in the Linux kernel. This vulnerability allows certain file system control FSCTL operations, specifically SETSPARSE, SETZERODATA, and SETCOMPRESSION, to use incorrect credentials. Consequently, these operations can bypass the security checks established when the file was...

CVE-2026-59650

A flaw was found in Bouncy Castle for Java. The software fails to validate Diffie-Hellman peer values during key agreement. A remote attacker can exploit this flaw to compromise cryptographic keys, potentially leading to the decryption of sensitive communications or successful impersonation...