CVE-2026-74506 is a use-after-free (UAF) vulnerability in the Linux kernel's AFS implementation. It occurs in the afs_make_call() function due to a race condition between asynchronous call reception and destruction, leading to potential memory access after the call object is freed. This flaw affects asynchronous calls where the call reference counting is mishandled. The vulnerability has been fixed by changing reference handling to ensure the call object is properly referenced during its lifecycle.
A vulnerability in the Linux kernel related to BPF programs attached to LSM cgroup was resolved. The kernel now rejects sleepable BPF_LSM_CGROUP programs at load time to prevent invalid context sleep calls. This issue could cause kernel crashes when such programs call certain functions like bpf_get_dentry_xattr. The flaw was fixed by adding verifier support to reject these sleepable programs for LSM cgroup attachment.
A vulnerability in the Linux kernel's NTFS3 filesystem driver was resolved by replacing a WARN_ON call with a safe call to _ntfs_bad_inode() when a rename operation fails. This fix prevents further operations on an inconsistent inode. The vulnerability affects multiple specific Linux kernel versions and has a high CVSS score of 9.8. The issue is addressed in updated kernel packages, and users should apply the official patches and reboot their systems.
A vulnerability in the Linux kernel's AMD XDNA acceleration driver allowed user command submissions without a valid command buffer object (BO), leading to a NULL pointer dereference and kernel oops. This flaw was due to insufficient validation of user-supplied command BO handles, permitting a process with access to the accel node on systems with AMD NPU to trigger a kernel crash via a crafted ioctl call. The issue has been resolved by rejecting invalid handles at the submission point.
A vulnerability in the Linux kernel's rxrpc subsystem allowed crafted ACKALL packets to cause a null-pointer dereference, leading to a denial of service. The flaw was due to improper state checking before processing ACKALL packets, which could trigger a crash when the call's transmit queue was NULL. The issue has been fixed by adding new call states and improving state validation for ACKALL packet handling.
CVE-2026-74305 is a high-severity vulnerability in the Linux kernel related to eBPF cgroup local storage handling. The flaw involves improper checks of cgroup storage cookies in program arrays, allowing a storage-less eBPF program to improperly bridge tail call chains between programs with and without cgroup storage. This can lead to out-of-bounds access and potential privilege escalation. The issue has been addressed with patches that tighten cookie checks to prevent unauthorized bridging while preserving legitimate tail calls. Multiple Linux kernel versions are affected, and fixes are available in specific 5.15.x kernel releases.
A vulnerability in the Linux kernel's net/sched subsystem (sch_dualpi2) could cause a null pointer dereference due to improper handling of queue length during packet peek operations. This flaw leads to incorrect deactivation of the parent's class and a general protection fault. The issue has been fixed in Linux kernel versions 7.0.0 and later.
CVE-2026-72500 is a high-severity vulnerability in the Linux kernel's RDMA bnxt_re driver where a toggle page is freed prematurely during firmware teardown. This can lead to a use-after-free condition if an NQ interrupt occurs during the destruction of an SRQ, potentially allowing an attacker to write to freed memory. The issue has been fixed by moving the free_page() call to after the firmware teardown completes.
CVE-2026-72499 is a high-severity vulnerability in the Linux kernel's RDMA bnxt_re driver. It involves improper freeing of a completion queue (CQ) toggle page before firmware teardown completes, which could lead to use-after-free conditions if an interrupt arrives during destruction. This flaw was fixed by moving the free_page() call to after the firmware teardown to prevent writing to freed memory.
A vulnerability in the Linux kernel's kernfs subsystem causes a NULL pointer dereference leading to a kernel panic when the LSM (Linux Security Module) init hook is invoked before the kernfs node's parent pointer is properly set. This occurs on SELinux-enabled systems during the creation of the first cgroup directory under /sys/fs/cgroup with a labelled parent, causing a deterministic kernel panic at PID 1 (systemd). The issue arises because kernfs_xattr_set() and kernfs_xattr_get() access kernfs_root(kn), which relies on kn->__parent being initialized, but this pointer is set too late in the node creation process. The fix involves moving the assignment of kn->__parent to before the LSM init hook call.
A vulnerability in the Linux kernel's rxrpc subsystem was fixed to properly handle the reception of a reply data packet before any request data packets are sent on a client call. Without this fix, the kernel could experience a crash (oops) due to improper handling of the transmission window. The issue was addressed by correcting the rxrpc_receiving_reply() function and modifying rxrpc_rotate_tx_window() to handle cases where the transmission queue is empty, such as when a call is terminated early by a reply. This vulnerability affects specific versions of the linux-hwe-edge kernel and has a CVSS score of 7.5.
A resource allocation flaw in the Linux kernel's mtd: rawnand: pl353 driver was fixed. The issue involved incorrect device reference during memory mapping in the probe function, causing the register area not to be released upon module unload. This could lead to resource leakage. The problem has been addressed by targeting the correct device in the devm_ioremap() call.
A vulnerability in the Linux kernel's Tegra GPIO driver caused redundant calls to the pinctrl core for GPIO direction changes. These redundant calls could sleep while holding a spinlock, leading to potential kernel stability issues. The flaw was identified through static analysis and manual code review. It has been fixed by removing the unnecessary pinctrl direction calls while preserving pinctrl involvement in GPIO request and free operations.
A vulnerability in the Linux kernel's TI ICSSG ethernet driver causes the function icssg_ndo_get_stats64() to unconditionally call emac_get_stat_by_name() with firmware PA stat names even when the PA stats block is not present. This leads to thousands of error log entries and silent corruption of network statistics counters such as rx_errors, rx_dropped, and tx_dropped. The issue arises because the error return value is widened to a large unsigned value when accumulated, distorting reported network statistics. The vulnerability has been fixed by adding a guard check to prevent calls when the PA stats block is absent.
A vulnerability in the Linux kernel's s390 architecture was fixed by adding a missing array_index_nospec() call to the memtop_get_page_count() function. The 'level' parameter is user-controlled and used to index an array, which could lead to speculative execution issues. This flaw was addressed by adding the missing speculative execution mitigation call.