SB2026080379 - Debian update for linux
Published: August 3, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 68 vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2026-64533)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in log_replay() in fs/ntfs3 when replaying a malformed NTFS filesystem restart table. A local user can provide a specially crafted filesystem image to cause a denial of service.
The issue occurs during conversion of DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records for version 0 restart tables.
2) NULL pointer dereference (CVE-ID: CVE-2026-64542)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in accept_untracked_na() when handling IPv6 neighbor advertisement packets. A local user can trigger concurrent network namespace activity to cause a denial of service.
It is reachable by an unprivileged user via a network namespace.
3) Use-after-free (CVE-ID: CVE-2026-64541)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in smc_cdc_rx_handler() when handling SMC-R CDC messages for a connection after releasing conns_lock. A local user can trigger a concurrent socket close while the handler continues to dereference the freed socket to cause a denial of service.
Only SMC-R is affected.
4) Out-of-bounds read (CVE-ID: CVE-2026-64540)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in genelink_rx_fixup() when processing device-supplied aggregated RX frames from a crafted GeneLink (GL620A) USB device. An attacker with physical access can provide a short URB with inconsistent packet length metadata to disclose sensitive information.
The issue can leak adjacent kernel heap contents to the network stack as soon as the USB network interface is up.
5) Stack-based buffer overflow (CVE-ID: CVE-2026-64539)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a stack-based buffer overflow in eir_create_adv_data() in the Bluetooth EIR advertising data builder when constructing legacy advertising data for an LE-only controller. A local user can supply crafted advertising instance data to trigger a stack out-of-bounds write and cause a denial of service.
Exploitation requires CAP_NET_ADMIN and access to the legacy advertising path on an LE-only controller.
6) NULL pointer dereference (CVE-ID: CVE-2026-64538)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in fib6_nh_mtu_change() when processing router advertisement-driven MTU changes. A remote attacker can send a specially crafted ICMPv6 router advertisement to cause a denial of service.
The issue can occur during interface teardown when the IPv6 device pointer has been cleared while nexthop-backed routes are still being walked.
7) Improper input validation (CVE-ID: CVE-2026-64537)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in the bridge cfm ccm transmission logic when configuring an invalid ccm interval. A local user can set an invalid expiration interval to trigger a tight workqueue loop and exhaust memory to cause a denial of service.
The issue can result in immediate re-arming of delayed work and repeated skb allocations until out-of-memory conditions occur.
8) Use-after-free (CVE-ID: CVE-2026-64535)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to a use-after-free in the NVMe/TCP target digest error handling in nvmet_tcp_try_recv_ddgst() and queue teardown logic when processing a digest mismatch on a non-final H2C_DATA PDU during an R2T-based data transfer. A remote user can trigger a digest mismatch to cause a denial of service.
Exploitation requires data digest to be enabled on the NVMe/TCP connection.
9) Use-after-free (CVE-ID: CVE-2026-64534)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in nvmet_tcp_try_recv_ddgst() when processing a command with a data digest mismatch after request initialization previously failed. A remote attacker can send a specially crafted request to cause a denial of service.
The issue can lead to a refcount underflow, kernel warnings, and a permanent workqueue deadlock.
10) Use-after-free (CVE-ID: CVE-2026-64543)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in tipc_disc_rcv() when processing TIPC discovery messages on a UDP bearer. A local user can trigger network namespace-accessible TIPC bearer operations and send crafted traffic to cause a denial of service.
Exploitation requires CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP. The affected functionality is reachable from an unprivileged user namespace because the TIPCv2 generic netlink family is netnsok and its bearer commands do not require GENL_ADMIN_PERM.
11) Out-of-bounds write (CVE-ID: CVE-2026-64532)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to out-of-bounds write in do_action() in fs/ntfs3/fslog.c when processing a crafted on-disk NTFS index entry in UpdateRecordDataRoot or UpdateRecordDataAllocation. A local user can mount or otherwise supply a specially crafted NTFS image to trigger the out-of-bounds write and cause a denial of service.
The issue occurs because view.data_off and the resulting write length are not properly bounded against the NTFS_DE entry size.
12) Improper input validation (CVE-ID: CVE-2026-64531)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of oversized nested action attributes in openvswitch flow action construction when processing user-supplied openvswitch nested action attributes. A local user can supply specially crafted nested CLONE or CT actions to cause a denial of service.
The issue occurs because a generated nested action attribute can be closed with a truncated nla_len, causing later dump or teardown operations to walk a structurally different action stream than the one that was validated.
13) Use-after-free (CVE-ID: CVE-2026-64530)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in tcf_qevent_handle in net/sched/cls_api.c when handling TC_ACT_CONSUMED during qevent processing of fragmented traffic. A local user can send specially crafted fragmented network traffic to trigger use of an skb after ownership has been transferred and cause a denial of service.
Exploitation requires RED qdisc qevents together with ct defragmentation and traffic that produces out-of-order fragments.
14) Use-after-free (CVE-ID: CVE-2026-64510)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the ACPI NFIT core when handling a subsequent ACPI Machine Check Exception after a failed or incomplete NFIT initialization and shutdown path. A local attacker can trigger the vulnerable initialization state to cause a denial of service.
The issue occurs because a freed acpi_desc object may remain referenced in the acpi_descs list and later be accessed by nfit_handle_mce().
15) Improper resource shutdown or release (CVE-ID: CVE-2026-64509)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown in GenDiskBuilder::build() and GenDisk::drop() in rust/kernel/block/mq/gen_disk.rs when handling gendisk cleanup on error and release paths. A local user can trigger the vulnerable cleanup paths to cause a denial of service.
Exploitation requires interacting with the Rust block layer gendisk functionality so that a temporary gendisk and request_queue remain unreleased or the final gendisk reference is not dropped during teardown.
16) Protection mechanism failure (CVE-ID: CVE-2026-64508)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass branch prediction isolation for reused BPF JIT memory.
The vulnerability exists due to improper isolation of indirect branch predictor state in the BPF JIT allocator when reusing JIT memory for newly written programs. A remote attacker can load and free BPF programs to bypass branch prediction isolation for reused BPF JIT memory.
Allocations larger than a pack are not covered by this condition, and the described attack surface is limited to cBPF programs that fit within pack size constraints.
17) Observable discrepancy (CVE-ID: CVE-2026-64507)
CWE-ID: CWE-203 - Observable discrepancy
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper protection against speculative execution in BPF JIT memory reuse on x86 systems when reusing JIT-compiled BPF memory under Spectre-v2 conditions. A local user can trigger BPF JIT allocation reuse to disclose sensitive information.
Only systems with BPF-JIT enabled are affected.
18) Out-of-bounds read (CVE-ID: CVE-2026-64551)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose uninitialized memory.
The vulnerability exists due to an out-of-bounds read in sctp_sf_do_5_2_6_stale() when processing an ERROR chunk with a STALE_COOKIE cause in the COOKIE_ECHOED state. A local user can send a specially crafted SCTP packet to disclose uninitialized memory.
The leaked value is echoed to the peer in the Cookie Preservative of the reply INIT. Exploitation is reachable by a peer that can drive an association into COOKIE_ECHOED, including an unprivileged process using a raw SCTP socket in a user and network namespace.
19) Use-after-free (CVE-ID: CVE-2026-64560)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to a use-after-free in the posix CPU timers subsystem when handling a non-leader exec() race involving POSIX CPU timer deletion, setting, or rearming. A local user can trigger concurrent exec() and timer operations to execute arbitrary code.
The issue occurs when a TGID-targeted timer remains inherited across exec(), and can also cause user-visible transient -ESRCH errors or prevent timer rearming.
20) Improper input validation (CVE-ID: CVE-2026-64559)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code or cause a denial of service.
The vulnerability exists due to improper input validation in the PKEY_VERIFYPROTK ioctl in drivers/s390/crypto/pkey_api.c when processing a user-supplied request structure from user space. A local user can provide a crafted buffer length value to execute arbitrary code or cause a denial of service.
21) Out-of-bounds write (CVE-ID: CVE-2026-64558)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to an out-of-bounds write in the pkey_pckmo key_to_protkey() handler implementation when processing a target buffer for generated output data. A local user can provide a target buffer with an insufficient length to execute arbitrary code.
22) Use-after-free (CVE-ID: CVE-2026-64557)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to use-after-free in l2cap_sock_new_connection_cb() in the Bluetooth L2CAP subsystem when handling a newly enqueued child socket reachable through the accept queue after the parent socket lock is released. A remote attacker can trigger a crafted Bluetooth L2CAP connection to execute arbitrary code.
The issue occurs because another task may accept and free the child socket before the callback dereferences it.
23) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64555)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause incorrect hypervisor state handling.
The vulnerability exists due to improper state management in kvm_hyp_handle_mops() when handling a MOPS exception during nested virtualization. A local user can trigger this code path to cause incorrect hypervisor state handling.
The issue affects arm64 KVM in nested virtualization scenarios.
24) Use-after-free (CVE-ID: CVE-2026-64554)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in br_ip6_fragment() when processing crafted IPv6 packets on a cloned skb. A local user can send a specially crafted packet to cause a denial of service.
The issue results from dereferencing a stale prevhdr pointer after skb_checksum_help() reallocates the skb head, and the resulting write can trigger a kernel panic.
25) Information disclosure (CVE-ID: CVE-2026-64553)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an information leak caused by improper clearing of padding bytes in PSAMPLE_ATTR_DATA handling in net/psample/psample.c when copying packet data into a netlink attribute. A local user can trigger processing of packet data whose length is not divisible by 4 bytes to disclose sensitive information.
The issue occurs because netlink attributes are padded to 4-byte boundaries.
26) Out-of-bounds write (CVE-ID: CVE-2026-64552)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to an out-of-bounds write in receive_big() when processing a device-announced packet length from a virtio backend. A remote attacker can announce a specially crafted length value to cause memory corruption.
The issue can result in a NULL fragment being handed up the receive path.
27) Improper resource shutdown or release (CVE-ID: CVE-2026-64493)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in mpl115_read_raw() in drivers/iio/pressure/mpl115.c when handling failed reads of processed pressure or raw temperature. A local user can trigger a read error to cause a denial of service.
The issue leaks a runtime PM reference on the error path and can prevent the device from autosuspending.
28) Out-of-bounds read (CVE-ID: CVE-2026-64550)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in rmnet_map_ingress_handler() and __rmnet_map_ingress_handler() when processing a crafted short MAP frame on the no-aggregation ingress path. A local user can send a specially crafted frame to disclose sensitive information.
The issue occurs when ingress deaggregation is disabled, causing packet parsing to use the on-wire packet length without verifying skb->len first.
29) Out-of-bounds read (CVE-ID: CVE-2026-64549)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in bpa10x_setup() when processing a crafted device response to the vendor command. An attacker with physical access can return a one-byte or unterminated response to disclose sensitive information.
The out-of-bounds data may be exposed through the kernel log and the firmware-info debugfs file.
30) Integer overflow (CVE-ID: CVE-2026-64548)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an integer overflow leading to an out-of-bounds write in bpf_msg_push_data() when processing a crafted len value in the copy fallback path. A local user can supply a crafted len value to cause a denial of service.
Exploitation requires access to BPF-driven sockmap message processing and occurs when the scatterlist ring is full or nearly full.
31) Out-of-bounds read (CVE-ID: CVE-2026-64547)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in net1080_rx_fixup() when processing a crafted short frame from a malicious NetChip 1080 device. An attacker with physical access can send a frame advertising a large even packet length to cause a denial of service.
32) Out-of-bounds read (CVE-ID: CVE-2026-64546)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in drm_parse_tiled_block() when parsing a crafted DisplayID tiled-display block in EDID data. A local user can supply crafted EDID data with a truncated tiled-display block to disclose sensitive information.
The issue is triggered when the tiled-display block declares a small payload length near the end of a DisplayID extension.
33) NULL pointer dereference (CVE-ID: CVE-2026-64545)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in xdp_master_redirect() when processing XDP_TX on a bond slave during upper-master unlinking. A local user can trigger packet processing in this race window to cause a denial of service.
The issue can lead to a kernel panic when the receiving device no longer has an upper-master adjacency but is still treated as a bond slave.
34) Out-of-bounds read (CVE-ID: CVE-2026-64544)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in pefile_digest_pe_contents when processing a crafted PE file. A local user can supply a specially crafted PE file to cause a denial of service.
The issue occurs because an unsigned subtraction can underflow after the trailing-data hash length calculation exceeds the PE length, which can lead to a kernel panic on unmapped vmalloc guard pages.
35) Use-after-free (CVE-ID: CVE-2026-64286)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of a stale pointer in flush_hyp_vcpu() when copying the host vCPU context into the hyp private vCPU. A local user can provide a crafted __hyp_running_vcpu value to cause a denial of service.
The issue occurs on arm64 KVM with pKVM at EL2 during vCPU context handling.
36) Improper handling of exceptional conditions (CVE-ID: CVE-2026-64369)
CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper exception handling in load_unaligned_zeropad() and the s390 secure storage access exception handler when reading unaligned data across page boundaries involving donated secure-execution pages. A local user can trigger the vulnerable kernel access pattern to cause a denial of service.
The issue can result in an endless exception loop when the second page access raises an exception for pages donated to the Ultravisor for secure execution purposes.
37) Out-of-bounds write (CVE-ID: CVE-2026-64364)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the HID multitouch driver when processing input from a crafted USB or Bluetooth HID multitouch device that advertises a large contact count. An attacker with physical access can provide a crafted device to corrupt adjacent members of struct mt_device and cause a denial of service.
The issue is reachable from an untrusted USB or Bluetooth HID multitouch device, and the kernel panic can be triggered from timer context through the sticky-fingers release path.
38) Use-after-free (CVE-ID: CVE-2026-64363)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to execute arbitrary code or cause a denial of service.
The vulnerability exists due to use-after-free in the appleir HID driver when processing concurrent device teardown and timer or raw event handling. A local attacker can trigger device disconnection shortly after key events to execute arbitrary code or cause a denial of service.
Exploitation requires a pending key-up timer or concurrent raw event activity to race with device removal.
39) Integer overflow (CVE-ID: CVE-2026-64361)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an integer overflow in check_and_correct_requested_length() in the hfs and hfsplus filesystem code when processing crafted filesystem metadata. A local user can trigger an underflowed length value that bypasses a bounds check to cause a denial of service.
Exploitation can result in a read far beyond the node buffer during a subsequent memmove operation.
40) Improper locking (CVE-ID: CVE-2026-64352)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper lock handling in the lpm trie implementation when sleepable BPF programs access LPM maps. A local user can trigger lockdep warnings through crafted BPF map lookup, update, or delete operations to cause a denial of service.
This issue is lockdep-only on debug kernels and can spam the console when a sleepable BPF LSM hook touches an LPM trie.
41) Use-after-free (CVE-ID: CVE-2026-64341)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to use-after-free in the iowarrior USB driver when release() races with disconnect(). A local user can trigger device release and disconnection in a racing condition to cause a denial of service or execute arbitrary code.
Exploitation requires access to the affected USB device interface.
42) Improper Initialization (CVE-ID: CVE-2026-64307)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper state management in the /dev/sev SNP_CONFIG ioctl handler when re-initializing SNP after a failed initialization. A local user can invoke the SNP_CONFIG ioctl to cause a denial of service.
Exploitation requires access to the SEV device interface, and the host crash condition arises when normal KVM virtual machines are actively running.
43) Out-of-bounds read (CVE-ID: CVE-2026-64287)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to cause a denial of service.
The vulnerability exists due to an out-of-bounds access in flush_hyp_vcpu() and the vGIC list register save and restore logic when copying host-controlled vgic_v3 state into the pKVM hyp vCPU. A local privileged user can provide a crafted used_lrs value to trigger out-of-bounds access at EL2 to cause a denial of service.
The issue affects arm64 KVM with pKVM and involves host-to-EL2 state transfer.
44) Race condition (CVE-ID: CVE-2026-64371)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper access control in procfs handlers for task statistics, wchan, map_files, and namespace links when accessing process information during concurrent exec state updates without exec_update_lock protection. A local user can access affected /proc interfaces to disclose sensitive information.
The issue involves calls to ptrace_may_access() without the required exec_update_lock protection.
45) NULL pointer dereference (CVE-ID: CVE-2026-64227)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of a NULL pointer in ACPI platform driver probe handlers when probing a platform device without an ACPI companion object. A local user can force a platform driver to match a device that does not match its device ID list to cause a denial of service.
The issue affects core ACPI-related platform drivers and can be triggered through driver override behavior.
46) Deadlock (CVE-ID: CVE-2026-64206)
CWE-ID: CWE-833 - Deadlock
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper locking in the Bluetooth L2CAP connection teardown path when canceling pending receive work during connection deletion. A remote attacker can trigger Bluetooth L2CAP traffic and connection teardown to cause a denial of service.
The issue can deadlock between the pending_rx_work worker and the teardown path in l2cap_conn_del().
47) Out-of-bounds write (CVE-ID: CVE-2026-64192)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in BPF_MAP_TYPE_INODE_STORAGE handling when creating and updating inode storage maps while the BPF LSM is uninitialized. A local privileged user can create and update a BPF_MAP_TYPE_INODE_STORAGE map to cause a denial of service.
This issue occurs when CONFIG_BPF_LSM is enabled but the BPF LSM is not enabled at boot time, causing the inode security blob offset to remain uninitialized and leading to a kernel panic during later RCU callback execution.
48) Improper resource shutdown or release (CVE-ID: CVE-2026-63970)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in virtio_transport_alloc_skb() in the vsock/virtio transport when processing fixed-buffer vectored zerocopy input that hits MAX_SKB_FRAGS. A local user can trigger a partial attachment of managed fragments to cause a denial of service.
Exploitation occurs on the rollback path after io_sg_from_iter() returns -EMSGSIZE, causing an skb with managed fragment references but no bound uarg to be freed through the ordinary fragment unref path.
49) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-53365)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource management in virtio vsock zerocopy completion handling in net/vmw_vsock/virtio_transport_common.c when processing multi-skb MSG_ZEROCOPY sends. A local user can send a large crafted message that is fragmented into multiple skbs to cause a denial of service.
The issue can leave pinned user pages without completion notification, including when the send loop exits before the final skb is processed.
50) Use-after-free (CVE-ID: CVE-2026-53260)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free race condition in reqsk_queue_hash_req() in net/ipv4/inet_connection_sock.c when handling TCP request socket timer setup and reference count initialization on PREEMPT_RT systems. A local user can trigger the race to cause a denial of service.
Exploitation requires a PREEMPT_RT-enabled kernel.
51) Use-after-free (CVE-ID: CVE-2026-53005)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the AF_UNIX SOCKMAP handling and garbage collection logic when processing socket buffers carrying SCM file descriptor attributes through SOCKMAP. A local user can send crafted AF_UNIX messages with SCM file descriptor attributes through SOCKMAP to cause a denial of service.
The issue arises because redirected socket buffers are not visible to AF_UNIX garbage collection, and user interaction is not required.
52) Improper locking (CVE-ID: CVE-2026-64428)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper lock type selection in the sch irq startup path when starting up a requested irq on PREEMPT_RT systems. A local user can request a threaded irq that reaches sch_irq_unmask() and sch_irq_mask_unmask() to cause a denial of service.
The issue occurs because the path is not sleepable, but a regular spinlock_t becomes a sleeping lock on PREEMPT_RT.
53) NULL pointer dereference (CVE-ID: CVE-2026-64488)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in sound/aoa/fabrics/layout.c when handling control creation failures in layout_attached_codec(). A local user can trigger a memory allocation failure that leads to dereferencing a NULL control pointer to cause a denial of service.
54) Use-after-free (CVE-ID: CVE-2026-64481)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the cs35l41_hda firmware load work and ALSA control handling when a firmware load is requested and queued work executes after component unbind or device removal. A local user can trigger a firmware load request and remove the component or device before the queued work runs to cause a denial of service.
Exploitation requires firmware autostart to be disabled and can occur before DSP initialization.
55) Race condition (CVE-ID: CVE-2026-64472)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in vfio/mlx5 page tracker and device state flag handling when concurrently updating runtime bitfields. A local user can trigger concurrent device operations to cause a denial of service.
The issue affects flags that can be updated during runtime, including dirty tracking, reset handling, tracker error handling, and VF attach or detach event processing.
56) Use-after-free (CVE-ID: CVE-2026-64462)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a stale pointer in the altera pcie irq handler teardown logic in drivers/pci/controller/pcie-altera.c when handling a probe failure after irq setup. A local user can trigger a driver probe failure to cause a denial of service.
The issue occurs because the chained IRQ handler and INTx IRQ domain can remain configured after probe failure while the associated devm-managed host bridge storage is released.
57) Improper resource shutdown or release (CVE-ID: CVE-2026-64461)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in the MediaTek PCIe controller driver when enabling a port fails during setup. A local user can trigger a port initialization failure to cause a denial of service.
The issue occurs in the probe error path after IRQ domains have already been created for the port.
58) Out-of-bounds read (CVE-ID: CVE-2026-64441)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in IE and WPS attribute parsing functions in drivers/staging/rtl8723bs/core/rtw_ieee80211.c when parsing crafted information element buffers. A local user can provide a specially crafted buffer to disclose sensitive information.
The issue affects rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr().
59) Use-after-free (CVE-ID: CVE-2026-64438)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the VF2PF response workqueue handling in the intel_qat SR-IOV implementation when processing VF2PF messages during SR-IOV teardown. A local user can trigger concurrent VF2PF work so that a queued or in-flight worker dereferences freed per-VF state to cause a denial of service.
The issue occurs because PF-side response work stores a raw pointer to per-VF state that may be freed by adf_disable_sriov() before queued work completes.
60) Use-after-free (CVE-ID: CVE-2026-64434)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the Bluetooth L2CAP channel timeout handler when processing an asynchronous channel timeout after the associated connection has been torn down. A local user can trigger a channel timeout race to cause a denial of service.
The issue arises because the timeout worker may access chan->conn after the underlying connection object has already been freed.
61) Race condition (CVE-ID: CVE-2026-45944)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a race condition in the Intel VT-d IOMMU context entry teardown logic when tearing down context entries. A local attacker can trigger use of a torn context entry to cause a denial of service.
The issue arises because the hardware may observe a partially updated 128-bit context entry while the Present bit remains set, resulting in unpredictable behavior or spurious faults.
62) Use-after-free (CVE-ID: CVE-2026-64421)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in mxc_isi_remove() and the imx8-isi media cleanup path when removing the imx8_isi module. A local user can trigger module removal to cause a denial of service.
The issue occurs because media links are removed after the media entity pads they reference have already been freed.
63) NULL pointer dereference (CVE-ID: CVE-2026-64416)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in lookup_swap_cgroup_id() when processing a corrupted swap entry during page table teardown. A local attacker can corrupt a page table entry into a crafted swap entry to cause a denial of service.
The issue is triggered on swapless hosts, and a single corrupted page table entry can crash the host during process exit.
64) Improper Initialization (CVE-ID: CVE-2026-64413)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper initialization in the ebtables table translation logic in net/bridge/netfilter/ebtables.c when allocating and freeing the chainstack array. A local user can trigger an allocation failure during table translation to cause a denial of service.
The issue arises when a sparse cpu_possible_mask causes an uninitialized chainstack entry to be freed during cleanup.
65) NULL pointer dereference (CVE-ID: CVE-2026-64405)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in hci_abort_conn() when handling connection cancellation from the hci_rx_work() receive path. A local user can trigger a pending Bluetooth connection state to cause a denial of service.
The issue can lead to a general protection fault while a connection request is pending and hdev->sent_cmd is NULL.
66) Use-after-free (CVE-ID: CVE-2026-64401)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the SMB client witness notification handling in fs/smb/client/cifs_swn.c when processing witness notifications for shared registrations. A local user can trigger notification handling involving a freed tcon pointer to cause a denial of service.
Exploitation requires a same-share second mount so that a registration remains live after the first tcon is unregistered and freed.
67) Use-after-free (CVE-ID: CVE-2026-64390)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in ksmbd byte-range lock handling when processing smb2 lock requests in smb3 multichannel environments. A remote attacker can trigger concurrent lock traversal and removal to cause a denial of service.
The issue occurs because a lock list entry can be removed under a different spinlock than the one protecting the list it belongs to.
68) Race condition (CVE-ID: CVE-2026-64375)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to a race condition in proc_pid_get_link() and proc_pid_readlink() when handling access to /proc pid link targets. A local user can trigger concurrent task state changes to disclose sensitive information.
The issue affects file descriptor-related proc links and involves ptrace_may_access() checks performed on a different task lookup than the one used for the actual access.
Remediation
Install update from vendor's website.