# ALAS2023-2026-2143: Security update for 18 packages

ALAS2023-2026-2143, released September 14, 2026, fixes 232 CVEs across 18 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2026-2143
- Platform: Linux
- Released: Sep 14, 2026
- Priority: Urgent (Closes CVE-2026-72299, rated Critical)
- CVEs: 232, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-2143.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | amzn 2023 | 1:6.1.186-228.374.amzn2023 |
| [bpftool-debuginfo](https://patchblox.com/security/data/product/linux/bpftool-debuginfo.md) | amzn 2023 | 1:6.1.186-228.374.amzn2023 |
| [kernel](https://patchblox.com/security/data/product/linux/kernel.md) | amzn 2023 | 1:6.1.186-228.374.amzn2023 |
| [kernel-debuginfo](https://patchblox.com/security/data/product/linux/kernel-debuginfo.md) | amzn 2023 | 1:6.1.186-228.374.amzn2023 |
| [kernel-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.1.186-228.374.amzn2023 |
| [kernel-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.1.186-228.374.amzn2023 |
| [kernel-devel](https://patchblox.com/security/data/product/linux/kernel-devel.md) | amzn 2023 | 1:6.1.186-228.374.amzn2023 |
| [kernel-headers](https://patchblox.com/security/data/product/linux/kernel-headers.md) | amzn 2023 | 1:6.1.186-228.374.amzn2023 |
| [kernel-livepatch-6.1.186-228.374](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.1.186-228.374.md) | amzn 2023 | 1:1.0-0.amzn2023 |
| [kernel-modules-extra](https://patchblox.com/security/data/product/linux/kernel-modules-extra.md) | amzn 2023 | 1:6.1.186-228.374.amzn2023 |
| [kernel-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel-modules-extra-common.md) | amzn 2023 | 1:6.1.186-228.374.amzn2023 |
| [kernel-tools](https://patchblox.com/security/data/product/linux/kernel-tools.md) | amzn 2023 | 1:6.1.186-228.374.amzn2023 |
| [kernel-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel-tools-debuginfo.md) | amzn 2023 | 1:6.1.186-228.374.amzn2023 |
| [kernel-tools-devel](https://patchblox.com/security/data/product/linux/kernel-tools-devel.md) | amzn 2023 | 1:6.1.186-228.374.amzn2023 |
| [perf](https://patchblox.com/security/data/product/linux/perf.md) | amzn 2023 | 1:6.1.186-228.374.amzn2023 |
| [perf-debuginfo](https://patchblox.com/security/data/product/linux/perf-debuginfo.md) | amzn 2023 | 1:6.1.186-228.374.amzn2023 |
| [python3-perf](https://patchblox.com/security/data/product/linux/python3-perf.md) | amzn 2023 | 1:6.1.186-228.374.amzn2023 |
| [python3-perf-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf-debuginfo.md) | amzn 2023 | 1:6.1.186-228.374.amzn2023 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-72299](https://patchblox.com/security/data/cve/CVE-2026-72299.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  tipc: restrict socket queue dumps in enqueue tra... | 9.8 | 0.0075 |  |
| [CVE-2026-72191](https://patchblox.com/security/data/cve/CVE-2026-72191.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  ntfs3: validate split-point offset in indx_inser... | 9.8 | 0.0070 |  |
| [CVE-2026-68127](https://patchblox.com/security/data/cve/CVE-2026-68127.md) | Urgent | ila: reload IPv6 header after pskb_may_pull in checksum adjust | 9.8 | 0.0054 |  |
| [CVE-2026-80557](https://patchblox.com/security/data/cve/CVE-2026-80557.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  libceph: fix OOB read in decode_watchers() via m... | 9.8 | 0.0053 |  |
| [CVE-2026-80681](https://patchblox.com/security/data/cve/CVE-2026-80681.md) | Urgent | vxlan: re-fetch eth header after route_shortcircuit() | 9.8 | 0.0050 |  |
| [CVE-2026-80725](https://patchblox.com/security/data/cve/CVE-2026-80725.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  net: gro: properly validate BIG TCP aggregation... | 9.8 | 0.0046 |  |
| [CVE-2026-68121](https://patchblox.com/security/data/cve/CVE-2026-68121.md) | Urgent | pppoe: reload header pointer after dev_hard_header() | 9.8 | 0.0037 |  |
| [CVE-2026-72288](https://patchblox.com/security/data/cve/CVE-2026-72288.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  KVM: arm64: vgic: Handle race between interrupt... | 9.3 | 0.0019 |  |
| [CVE-2026-68132](https://patchblox.com/security/data/cve/CVE-2026-68132.md) | Urgent | super: fix emergency thaw deadlock on frozen block devices | 9.8 | 0.0018 |  |
| [CVE-2026-68146](https://patchblox.com/security/data/cve/CVE-2026-68146.md) | Urgent | ftrace: Add global mutex to serialize trace_parser access | 9.8 | 0.0018 |  |
| [CVE-2026-68325](https://patchblox.com/security/data/cve/CVE-2026-68325.md) | Urgent | iommu/amd: Bound the early ACPI HID map | 9.8 | 0.0018 |  |
| [CVE-2026-80686](https://patchblox.com/security/data/cve/CVE-2026-80686.md) | Urgent | mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE | 9.8 | 0.0017 |  |
| [CVE-2026-68399](https://patchblox.com/security/data/cve/CVE-2026-68399.md) | Urgent | bpf: Fix UAF in sock clone early bailouts | 9.8 | 0.0017 |  |
| [CVE-2026-64562](https://patchblox.com/security/data/cve/CVE-2026-64562.md) | Urgent | KVM: nVMX: Hide shadow VMCS right after VMCLEAR | 9.8 | 0.0016 |  |
| [CVE-2026-80715](https://patchblox.com/security/data/cve/CVE-2026-80715.md) | Urgent | igc: remove napi_synchronize() in igc_down() | 9.8 | 0.0016 |  |
| [CVE-2026-68153](https://patchblox.com/security/data/cve/CVE-2026-68153.md) | Urgent | libceph: remove debugfs files before client teardown | 9.8 | 0.0013 |  |
| [CVE-2026-68142](https://patchblox.com/security/data/cve/CVE-2026-68142.md) | Urgent | geneve: require CAP_NET_ADMIN in the device netns for changelink | 9.8 | 0.0012 |  |
| [CVE-2026-74469](https://patchblox.com/security/data/cve/CVE-2026-74469.md) | High | sctp: prevent peer transport count overflow | 8.8 | 0.0147 |  |
| [CVE-2026-72398](https://patchblox.com/security/data/cve/CVE-2026-72398.md) | High | sctp: add INIT verification after cookie unpacking | 9.8 | 0.0080 |  |
| [CVE-2026-68159](https://patchblox.com/security/data/cve/CVE-2026-68159.md) | High | libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE | 9.8 | 0.0075 |  |
| [CVE-2026-68154](https://patchblox.com/security/data/cve/CVE-2026-68154.md) | High | libceph: reject zero bucket types in crush_decode | 9.8 | 0.0071 |  |
| [CVE-2026-68158](https://patchblox.com/security/data/cve/CVE-2026-68158.md) | High | libceph: Fix multiplication overflow in decode_new_up_state_weight() | 9.8 | 0.0071 |  |
| [CVE-2026-72242](https://patchblox.com/security/data/cve/CVE-2026-72242.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  selinux: avoid sk_socket dereference in selinux_... | 8.8 | 0.0070 |  |
| [CVE-2026-68157](https://patchblox.com/security/data/cve/CVE-2026-68157.md) | High | libceph: guard missing CRUSH type name lookup | 7.8 | 0.0070 |  |
| [CVE-2026-72253](https://patchblox.com/security/data/cve/CVE-2026-72253.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  netfilter: nf_conntrack_sip: validate skb_dst()... | 7.5 | 0.0070 |  |
| [CVE-2026-68156](https://patchblox.com/security/data/cve/CVE-2026-68156.md) | High | libceph: refresh auth->authorizer_buf{,_len} after authorizer update | 9.8 | 0.0069 |  |
| [CVE-2026-68376](https://patchblox.com/security/data/cve/CVE-2026-68376.md) | High | sctp: fix auth_hmacs array size in struct sctp_cookie | 8.1 | 0.0061 |  |
| [CVE-2026-68300](https://patchblox.com/security/data/cve/CVE-2026-68300.md) | High | sctp: auth: verify auth requirement when auth_chunk is NULL | 9.8 | 0.0058 |  |
| [CVE-2026-74480](https://patchblox.com/security/data/cve/CVE-2026-74480.md) | High | net: bridge: stop fast-leave after deleting a port group | 9.8 | 0.0058 |  |
| [CVE-2026-80590](https://patchblox.com/security/data/cve/CVE-2026-80590.md) | High | inet: frags: strip GSO state from fragments before reassembly | 8.8 | 0.0058 |  |
| [CVE-2026-68123](https://patchblox.com/security/data/cve/CVE-2026-68123.md) | High | openvswitch: fix GSO userspace truncation underflow | 9.8 | 0.0055 |  |
| [CVE-2026-72099](https://patchblox.com/security/data/cve/CVE-2026-72099.md) | High | kernel-64k-debug-devel: The kernel packages contain the Linux kernel, the core of any Linux operating system.  Security Fix(es):  * kernel: t... | 7.8 | 0.0055 |  |
| [CVE-2026-74597](https://patchblox.com/security/data/cve/CVE-2026-74597.md) | High | ip6_tunnel: clear skb2->cb[] in ip6ip6_err() | 9.8 | 0.0054 |  |
| [CVE-2026-68136](https://patchblox.com/security/data/cve/CVE-2026-68136.md) | High | net: gro: fix double aggregation of flush-marked skbs | 9.8 | 0.0054 |  |
| [CVE-2026-74743](https://patchblox.com/security/data/cve/CVE-2026-74743.md) | High | macvlan: inherit needed_headroom and needed_tailroom from lowerdev | 9.8 | 0.0054 |  |
| [CVE-2026-74746](https://patchblox.com/security/data/cve/CVE-2026-74746.md) | High | netfilter: flowtable: publish GC-visible tuple last | 9.8 | 0.0054 |  |
| [CVE-2026-68096](https://patchblox.com/security/data/cve/CVE-2026-68096.md) | High | audit: fix recursive locking deadlock in audit_dupe_exe() | 7.5 | 0.0053 |  |
| [CVE-2026-68117](https://patchblox.com/security/data/cve/CVE-2026-68117.md) | High | tipc: clear sock->sk on the failed-insert path in tipc_sk_create() | 9.8 | 0.0053 |  |
| [CVE-2026-74473](https://patchblox.com/security/data/cve/CVE-2026-74473.md) | High | vxlan: use pskb_network_may_pull() in route_shortcircuit() | 9.8 | 0.0053 |  |
| [CVE-2026-68388](https://patchblox.com/security/data/cve/CVE-2026-68388.md) | High | smb/client: handle overlapping allocated ranges in fallocate | 9.8 | 0.0051 |  |
| [CVE-2026-74662](https://patchblox.com/security/data/cve/CVE-2026-74662.md) | High | inet: frags: publish queues before arming timer | 9.8 | 0.0051 |  |
| [CVE-2026-74669](https://patchblox.com/security/data/cve/CVE-2026-74669.md) | High | ipvs: clear IPv4 options after rebasing tunnel ICMP errors | 9.8 | 0.0051 |  |
| [CVE-2026-80528](https://patchblox.com/security/data/cve/CVE-2026-80528.md) | High | ceph: avoid fs reclaim while using current->journal_info | 9.8 | 0.0051 |  |
| [CVE-2026-80558](https://patchblox.com/security/data/cve/CVE-2026-80558.md) | High | libceph: Avoid using invalid osd indices from primary_temp | 9.8 | 0.0051 |  |
| [CVE-2026-80561](https://patchblox.com/security/data/cve/CVE-2026-80561.md) | High | libceph: fix multiple unsafe decodes in decode_locker() | 9.8 | 0.0051 |  |
| [CVE-2026-74616](https://patchblox.com/security/data/cve/CVE-2026-74616.md) | High | xdp: reject clones that overrun skb_shared_info tailroom | 9.8 | 0.0051 |  |
| [CVE-2026-68343](https://patchblox.com/security/data/cve/CVE-2026-68343.md) | High | smb: client: validate DFS referral PathConsumed | 9.1 | 0.0051 |  |
| [CVE-2026-74744](https://patchblox.com/security/data/cve/CVE-2026-74744.md) | High | ipvlan: inherit needed_headroom and needed_tailroom from phy_dev | 9.8 | 0.0051 |  |
| [CVE-2026-68315](https://patchblox.com/security/data/cve/CVE-2026-68315.md) | High | sctp: validate stream count in sctp_process_strreset_inreq() | 8.8 | 0.0051 |  |
| [CVE-2026-74730](https://patchblox.com/security/data/cve/CVE-2026-74730.md) | High | NFS: Pin the 'struct nfs_server' during a FREE_STATEID call | 9.8 | 0.0051 |  |
| [CVE-2026-80527](https://patchblox.com/security/data/cve/CVE-2026-80527.md) | High | ceph: fix hanging __ceph_get_caps() with stale mds_wanted | 7.8 | 0.0050 |  |
| [CVE-2026-74717](https://patchblox.com/security/data/cve/CVE-2026-74717.md) | High | net/mlx5: fw_tracer, return NULL on create error | 7.5 | 0.0050 |  |
| [CVE-2026-74705](https://patchblox.com/security/data/cve/CVE-2026-74705.md) | High | udp: fix potential use-after-free in tunnel segmentation | 10.0 | 0.0050 |  |
| [CVE-2026-74586](https://patchblox.com/security/data/cve/CVE-2026-74586.md) | High | sctp: clear new_transport when removing a peer | 9.8 | 0.0050 |  |
| [CVE-2026-74587](https://patchblox.com/security/data/cve/CVE-2026-74587.md) | High | sctp: fix use-after-free of cached ASCONF chunk | 9.8 | 0.0050 |  |
| [CVE-2026-74588](https://patchblox.com/security/data/cve/CVE-2026-74588.md) | High | sctp: keep chunk->transport in step with the list it is queued on | 9.8 | 0.0050 |  |
| [CVE-2026-74688](https://patchblox.com/security/data/cve/CVE-2026-74688.md) | High | sctp: clear control chunk transport if it is being removed | 9.8 | 0.0050 |  |
| [CVE-2026-68082](https://patchblox.com/security/data/cve/CVE-2026-68082.md) | High | libceph: fix two unsafe bare decodes in decode_lockers() | 9.8 | 0.0050 |  |
| [CVE-2026-74612](https://patchblox.com/security/data/cve/CVE-2026-74612.md) | High | veth: fix skb length accounting after XDP frag adjustment | 10.0 | 0.0049 |  |
| [CVE-2026-74476](https://patchblox.com/security/data/cve/CVE-2026-74476.md) | High | veth: convert frag_list skbs before running XDP | 9.1 | 0.0049 |  |
| [CVE-2026-74696](https://patchblox.com/security/data/cve/CVE-2026-74696.md) | High | tcp: fix TFO max_qlen accounting across reuseport migration | 7.5 | 0.0049 |  |
| [CVE-2026-80714](https://patchblox.com/security/data/cve/CVE-2026-80714.md) | High | ipvs: do not propagate one-packet flag to synced conns | 9.8 | 0.0048 |  |
| [CVE-2026-74550](https://patchblox.com/security/data/cve/CVE-2026-74550.md) | High | net: do not send ICMP/NDISC Redirects when peer allocation fails | 7.5 | 0.0048 |  |
| [CVE-2026-74624](https://patchblox.com/security/data/cve/CVE-2026-74624.md) | High | netfilter: nf_conntrack: defer invalid log until after unlock | 7.5 | 0.0048 |  |
| [CVE-2026-74608](https://patchblox.com/security/data/cve/CVE-2026-74608.md) | High | smb: client: Fix use-after-free in cifs_try_adding_channels() | 9.8 | 0.0048 |  |
| [CVE-2026-74490](https://patchblox.com/security/data/cve/CVE-2026-74490.md) | High | tipc: avoid use-after-free in poll trace queue dumps | 8.8 | 0.0046 |  |
| [CVE-2026-74475](https://patchblox.com/security/data/cve/CVE-2026-74475.md) | High | vxlan: use neigh_ha_snapshot() in route_shortcircuit() | 10.0 | 0.0045 |  |
| [CVE-2026-74704](https://patchblox.com/security/data/cve/CVE-2026-74704.md) | High | net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter | 8.2 | 0.0044 |  |
| [CVE-2026-74598](https://patchblox.com/security/data/cve/CVE-2026-74598.md) | High | ipv6: fix Route Information option length validation | 7.5 | 0.0043 |  |
| [CVE-2026-74581](https://patchblox.com/security/data/cve/CVE-2026-74581.md) | High | net: ipv6: clear suppressed fib6 rule result | 9.8 | 0.0042 |  |
| [CVE-2026-80586](https://patchblox.com/security/data/cve/CVE-2026-80586.md) | High | mptcp: options: reset DSS fields in case of unexpected size | 9.8 | 0.0040 |  |
| [CVE-2026-74569](https://patchblox.com/security/data/cve/CVE-2026-74569.md) | High | netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() | 9.8 | 0.0039 |  |
| [CVE-2026-80589](https://patchblox.com/security/data/cve/CVE-2026-80589.md) | High | block: stop the timeout timer when releasing a never added disk | 9.8 | 0.0037 |  |
| [CVE-2026-68433](https://patchblox.com/security/data/cve/CVE-2026-68433.md) | High | libceph: bound get_version reply decode to front len | 8.6 | 0.0036 |  |
| [CVE-2026-72121](https://patchblox.com/security/data/cve/CVE-2026-72121.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  can: bcm: add locking when updating filter and t... | 8.8 | 0.0035 |  |
| [CVE-2026-74557](https://patchblox.com/security/data/cve/CVE-2026-74557.md) | High | scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer | 7.5 | 0.0033 |  |
| [CVE-2026-80717](https://patchblox.com/security/data/cve/CVE-2026-80717.md) | High | sctp: validate Adaptation Indication parameter length | 7.5 | 0.0033 |  |
| [CVE-2026-72115](https://patchblox.com/security/data/cve/CVE-2026-72115.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  can: bcm: track a single source interface for AN... | 8.1 | 0.0030 |  |
| [CVE-2026-68425](https://patchblox.com/security/data/cve/CVE-2026-68425.md) | High | IB/mad: Drop unmatched RMPP responses before reassembly | 7.1 | 0.0026 |  |
| [CVE-2026-68278](https://patchblox.com/security/data/cve/CVE-2026-68278.md) | High | drm/dp/mst: fix buffer overflows in sideband chunk accumulation | 8.1 | 0.0024 |  |
| [CVE-2026-64507](https://patchblox.com/security/data/cve/CVE-2026-64507.md) | High | x86/bugs: Enable IBPB flush on BPF JIT allocation | 7.8 | 0.0023 |  |
| [CVE-2026-68186](https://patchblox.com/security/data/cve/CVE-2026-68186.md) | High | binfmt_misc: set have_execfd only once the interpreter is opened | 7.8 | 0.0022 |  |
| [CVE-2026-68165](https://patchblox.com/security/data/cve/CVE-2026-68165.md) | High | mm/damon/core: validate ranges in damon_set_regions() | 7.1 | 0.0021 |  |
| [CVE-2026-64572](https://patchblox.com/security/data/cve/CVE-2026-64572.md) | High | ipv4: fib: free fib_alias with kfree_rcu() on insert error path | 8.8 | 0.0020 |  |
| [CVE-2026-68162](https://patchblox.com/security/data/cve/CVE-2026-68162.md) | High | sctp: avoid auth_enable sysctl UAF during netns teardown | 8.8 | 0.0020 |  |
| [CVE-2026-80792](https://patchblox.com/security/data/cve/CVE-2026-80792.md) | High | ipv6: fix use-after-free in ip6_finish_output2() | 8.1 | 0.0020 |  |
| [CVE-2026-80808](https://patchblox.com/security/data/cve/CVE-2026-80808.md) | High | ext4: stop retrying saturated xattr cache entries | 7.0 | 0.0020 |  |
| [CVE-2026-64508](https://patchblox.com/security/data/cve/CVE-2026-64508.md) | High | bpf: Support for hardening against JIT spraying | 7.8 | 0.0019 |  |
| [CVE-2026-68255](https://patchblox.com/security/data/cve/CVE-2026-68255.md) | High | drm/virtio: bound EDID block reads to the response buffer | 7.7 | 0.0019 |  |
| [CVE-2026-72116](https://patchblox.com/security/data/cve/CVE-2026-72116.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  can: bcm: fix stale rx/tx ops after device remov... | 7.1 | 0.0019 |  |
| [CVE-2026-68093](https://patchblox.com/security/data/cve/CVE-2026-68093.md) | High | KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug | 7.0 | 0.0019 |  |
| [CVE-2026-80916](https://patchblox.com/security/data/cve/CVE-2026-80916.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  kcov: fix data corruption and race conditions on... | 7.8 | 0.0018 |  |
| [CVE-2026-74672](https://patchblox.com/security/data/cve/CVE-2026-74672.md) | High | mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF | 7.0 | 0.0018 |  |
| [CVE-2026-72416](https://patchblox.com/security/data/cve/CVE-2026-72416.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_compat: ebtables emulation must r... | 7.3 | 0.0017 |  |
| [CVE-2026-80893](https://patchblox.com/security/data/cve/CVE-2026-80893.md) | High | mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() | 7.0 | 0.0017 |  |
| [CVE-2026-72110](https://patchblox.com/security/data/cve/CVE-2026-72110.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  bpf,fork: wipe ->bpf_storage before bailouts tha... | 7.8 | 0.0017 |  |
| [CVE-2026-72113](https://patchblox.com/security/data/cve/CVE-2026-72113.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  can: bcm: add missing device refcount for CAN fi... | 7.8 | 0.0017 |  |
| [CVE-2026-72114](https://patchblox.com/security/data/cve/CVE-2026-72114.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  can: bcm: validate frame length in bcm_rx_setup(... | 7.8 | 0.0017 |  |
| [CVE-2026-72119](https://patchblox.com/security/data/cve/CVE-2026-72119.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  can: bcm: extend bcm_tx_lock usage for data and... | 7.8 | 0.0017 |  |
| [CVE-2026-72172](https://patchblox.com/security/data/cve/CVE-2026-72172.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  mm/mm_init: fix uninitialized struct pages for Z... | 7.8 | 0.0017 |  |
| [CVE-2026-72252](https://patchblox.com/security/data/cve/CVE-2026-72252.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_set_pipapo: don't leak bad clone... | 7.8 | 0.0017 |  |
| [CVE-2026-64563](https://patchblox.com/security/data/cve/CVE-2026-64563.md) | High | rhashtable: clear stale iter->p on table restart | 8.1 | 0.0017 |  |
| [CVE-2026-64556](https://patchblox.com/security/data/cve/CVE-2026-64556.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  perf/core: Detach event groups during remove_on_... | 8.8 | 0.0016 |  |
| [CVE-2026-90347](https://patchblox.com/security/data/cve/CVE-2026-90347.md) | High | arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry | 8.4 | 0.0016 |  |
| [CVE-2026-80904](https://patchblox.com/security/data/cve/CVE-2026-80904.md) | High | net/tls: Fail tls_sw_splice_read() after a failed async decrypt | 7.8 | 0.0016 |  |
| [CVE-2026-64294](https://patchblox.com/security/data/cve/CVE-2026-64294.md) | High | mm: do file ownership checks with the proper mount idmap | 7.1 | 0.0016 |  |
| [CVE-2026-74465](https://patchblox.com/security/data/cve/CVE-2026-74465.md) | High | net: openvswitch: fix potential UAF on meter attach failure | 7.8 | 0.0015 |  |
| [CVE-2026-68432](https://patchblox.com/security/data/cve/CVE-2026-68432.md) | High | vxlan: require CAP_NET_ADMIN in the device netns for changelink | 8.8 | 0.0015 |  |
| [CVE-2026-74519](https://patchblox.com/security/data/cve/CVE-2026-74519.md) | High | pinctrl: devicetree: don't free uninitialized dev_name on error path | 7.8 | 0.0015 |  |
| [CVE-2026-74684](https://patchblox.com/security/data/cve/CVE-2026-74684.md) | High | net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() | 7.1 | 0.0015 |  |
| [CVE-2026-68253](https://patchblox.com/security/data/cve/CVE-2026-68253.md) | High | drm/i915/hdcp: check streams[] bounds before overflow | 7.8 | 0.0014 |  |
| [CVE-2026-74492](https://patchblox.com/security/data/cve/CVE-2026-74492.md) | High | netfilter: ipset: do not update comments from kernel-side hash adds | 8.4 | 0.0014 |  |
| [CVE-2026-74614](https://patchblox.com/security/data/cve/CVE-2026-74614.md) | High | vsock/virtio: read virtqueues under worker locks | 8.4 | 0.0014 |  |
| [CVE-2026-80536](https://patchblox.com/security/data/cve/CVE-2026-80536.md) | High | xfs: bounds-check buffer log item's dirty bitmap | 8.4 | 0.0014 |  |
| [CVE-2026-80731](https://patchblox.com/security/data/cve/CVE-2026-80731.md) | High | net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header | 7.8 | 0.0014 |  |
| [CVE-2026-53090](https://patchblox.com/security/data/cve/CVE-2026-53090.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  bpf: Fix ld_{abs,ind} failure path analysis in s... | 7.8 | 0.0014 |  |
| [CVE-2026-74739](https://patchblox.com/security/data/cve/CVE-2026-74739.md) | High | net/sched: cls_u32: skip hash tables in u32_bind_class() | 7.8 | 0.0014 |  |
| [CVE-2026-74748](https://patchblox.com/security/data/cve/CVE-2026-74748.md) | High | netfilter: ipset: fix refcount race between list:set GC and swap | 7.8 | 0.0014 |  |
| [CVE-2026-74589](https://patchblox.com/security/data/cve/CVE-2026-74589.md) | High | bpf, sockmap: Fix sk_redir use-after-free in send verdict | 8.4 | 0.0014 |  |
| [CVE-2026-74601](https://patchblox.com/security/data/cve/CVE-2026-74601.md) | High | ring-buffer: Use current_context for safe per-CPU buffer swap | 7.8 | 0.0014 |  |
| [CVE-2026-74667](https://patchblox.com/security/data/cve/CVE-2026-74667.md) | High | net/packet: reset the MAC header on the packet-socket transmit path | 7.8 | 0.0014 |  |
| [CVE-2026-74516](https://patchblox.com/security/data/cve/CVE-2026-74516.md) | High | KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active | 8.8 | 0.0014 |  |
| [CVE-2026-68284](https://patchblox.com/security/data/cve/CVE-2026-68284.md) | High | bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() | 7.8 | 0.0014 |  |
| [CVE-2026-80574](https://patchblox.com/security/data/cve/CVE-2026-80574.md) | High | Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet | 8.4 | 0.0013 |  |
| [CVE-2026-74481](https://patchblox.com/security/data/cve/CVE-2026-74481.md) | High | mm/page_reporting: use system_freezable_wq to fix UAF during suspend | 7.8 | 0.0013 |  |
| [CVE-2026-68297](https://patchblox.com/security/data/cve/CVE-2026-68297.md) | High | tipc: fix u16 MTU truncation in media and bearer MTU validation | 7.8 | 0.0013 |  |
| [CVE-2026-74701](https://patchblox.com/security/data/cve/CVE-2026-74701.md) | High | net/openvswitch: check Ethernet header length in key_extract() | 7.8 | 0.0013 |  |
| [CVE-2026-74443](https://patchblox.com/security/data/cve/CVE-2026-74443.md) | High | drm/vmwgfx: bound DMA command body size against suffix pointer | 8.8 | 0.0013 |  |
| [CVE-2026-74347](https://patchblox.com/security/data/cve/CVE-2026-74347.md) | High | netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount | 7.8 | 0.0013 |  |
| [CVE-2026-74444](https://patchblox.com/security/data/cve/CVE-2026-74444.md) | High | drm/vmwgfx: validate DRAW_PRIMITIVES header size before division | 7.8 | 0.0013 |  |
| [CVE-2026-74594](https://patchblox.com/security/data/cve/CVE-2026-74594.md) | High | sched/psi: Shut down rtpoll_timer in psi_cgroup_free() | 7.8 | 0.0013 |  |
| [CVE-2026-74632](https://patchblox.com/security/data/cve/CVE-2026-74632.md) | High | mm/huge_memory: fix huge_zero_pfn race | 7.8 | 0.0013 |  |
| [CVE-2026-74635](https://patchblox.com/security/data/cve/CVE-2026-74635.md) | High | fbdev: bitblit: bound-check glyph index in bit_cursor() | 7.8 | 0.0013 |  |
| [CVE-2026-74663](https://patchblox.com/security/data/cve/CVE-2026-74663.md) | High | net/sched: reject overly deep qdisc hierarchies | 7.8 | 0.0013 |  |
| [CVE-2026-74666](https://patchblox.com/security/data/cve/CVE-2026-74666.md) | High | packet: synchronize pressure clearing with ring reconfiguration | 7.8 | 0.0013 |  |
| [CVE-2026-74668](https://patchblox.com/security/data/cve/CVE-2026-74668.md) | High | packet: use consistent hard_header_len in TX_RING send path | 7.8 | 0.0013 |  |
| [CVE-2026-74675](https://patchblox.com/security/data/cve/CVE-2026-74675.md) | High | vt: stabilize tty reference in kbd_keycode with tty_port_tty_get | 7.8 | 0.0013 |  |
| [CVE-2026-74720](https://patchblox.com/security/data/cve/CVE-2026-74720.md) | High | bpf: Preserve pointer state for commuted arithmetic | 7.8 | 0.0013 |  |
| [CVE-2026-80737](https://patchblox.com/security/data/cve/CVE-2026-80737.md) | High | serial: amba-pl011: synchronize DMA teardown | 7.8 | 0.0013 |  |
| [CVE-2026-74630](https://patchblox.com/security/data/cve/CVE-2026-74630.md) | High | ipv6: prevent in6_dev_get() from resurrecting inet6_dev | 7.8 | 0.0013 |  |
| [CVE-2026-68320](https://patchblox.com/security/data/cve/CVE-2026-68320.md) | High | sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid | 7.5 | 0.0013 |  |
| [CVE-2026-46158](https://patchblox.com/security/data/cve/CVE-2026-46158.md) | High | mptcp: pm: ADD_ADDR rtx: always decrease sk refcount | 7.0 | 0.0013 |  |
| [CVE-2026-46170](https://patchblox.com/security/data/cve/CVE-2026-46170.md) | High | mptcp: pm: ADD_ADDR rtx: free sk if last | 7.0 | 0.0013 |  |
| [CVE-2026-74518](https://patchblox.com/security/data/cve/CVE-2026-74518.md) | High | mm/hugetlb: fix list corruption in allocate_file_region_entries() | 8.8 | 0.0013 |  |
| [CVE-2026-74615](https://patchblox.com/security/data/cve/CVE-2026-74615.md) | High | vxlan: do not arm the ageing timer on a device that is down | 8.8 | 0.0013 |  |
| [CVE-2026-64543](https://patchblox.com/security/data/cve/CVE-2026-64543.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  tipc: fix use-after-free of the discoverer in ti... | 7.8 | 0.0013 |  |
| [CVE-2026-74471](https://patchblox.com/security/data/cve/CVE-2026-74471.md) | High | tracing: Check return value of __register_event() in trace_module_add_events() | 7.8 | 0.0013 |  |
| [CVE-2026-74482](https://patchblox.com/security/data/cve/CVE-2026-74482.md) | High | mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios | 7.8 | 0.0013 |  |
| [CVE-2026-74512](https://patchblox.com/security/data/cve/CVE-2026-74512.md) | High | audit: fix potential use-after-free in audit_del_rule() | 7.8 | 0.0013 |  |
| [CVE-2026-74609](https://patchblox.com/security/data/cve/CVE-2026-74609.md) | High | tipc: read le->link under the node lock in tipc_node_link_down() | 7.8 | 0.0013 |  |
| [CVE-2026-74613](https://patchblox.com/security/data/cve/CVE-2026-74613.md) | High | vsock/virtio: avoid refilling the RX queue after teardown | 7.8 | 0.0013 |  |
| [CVE-2026-74637](https://patchblox.com/security/data/cve/CVE-2026-74637.md) | High | perf/core: Fix group leader use-after-free after sibling detach | 7.8 | 0.0013 |  |
| [CVE-2026-74656](https://patchblox.com/security/data/cve/CVE-2026-74656.md) | High | ipv4: fix use-after-free in fib_nhc_update_mtu() | 7.8 | 0.0013 |  |
| [CVE-2026-74660](https://patchblox.com/security/data/cve/CVE-2026-74660.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  netfilter: ebt_nflog: pin the NFLOG backend  nf_... | 7.8 | 0.0013 |  |
| [CVE-2026-74700](https://patchblox.com/security/data/cve/CVE-2026-74700.md) | High | net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers | 7.8 | 0.0013 |  |
| [CVE-2026-74714](https://patchblox.com/security/data/cve/CVE-2026-74714.md) | High | bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() | 7.8 | 0.0013 |  |
| [CVE-2026-74726](https://patchblox.com/security/data/cve/CVE-2026-74726.md) | High | bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor | 7.3 | 0.0013 |  |
| [CVE-2026-74485](https://patchblox.com/security/data/cve/CVE-2026-74485.md) | High | binfmt_misc: reject a flag character as the field delimiter | 7.1 | 0.0013 |  |
| [CVE-2026-64567](https://patchblox.com/security/data/cve/CVE-2026-64567.md) | High | btrfs: reject free space cache with more entries than pages | 7.8 | 0.0013 |  |
| [CVE-2026-64580](https://patchblox.com/security/data/cve/CVE-2026-64580.md) | High | xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() | 7.8 | 0.0013 |  |
| [CVE-2026-74565](https://patchblox.com/security/data/cve/CVE-2026-74565.md) | High | netfilter: nf_tables: make nft_object rhltable per table | 7.8 | 0.0012 |  |
| [CVE-2026-74724](https://patchblox.com/security/data/cve/CVE-2026-74724.md) | High | ipvs: avoid out-of-bounds write in ip_vs_nat_icmp | 7.8 | 0.0012 |  |
| [CVE-2026-68446](https://patchblox.com/security/data/cve/CVE-2026-68446.md) | High | drm/vmwgfx: Validate vmw_surface_metadata::array_size | 7.8 | 0.0012 |  |
| [CVE-2026-64576](https://patchblox.com/security/data/cve/CVE-2026-64576.md) | High | nexthop: initialize extack in nh_res_bucket_migrate() | 7.1 | 0.0012 |  |
| [CVE-2026-74582](https://patchblox.com/security/data/cve/CVE-2026-74582.md) | High | packet: use consistent hard_header_len in non-ring send paths | 9.8 | 0.0012 |  |
| [CVE-2026-80572](https://patchblox.com/security/data/cve/CVE-2026-80572.md) | High | Input: byd - synchronize timer deletion before freeing private data | 7.8 | 0.0012 |  |
| [CVE-2026-74579](https://patchblox.com/security/data/cve/CVE-2026-74579.md) | High | netfilter: nft_payload: fix mask build for partial field offload | 7.1 | 0.0012 |  |
| [CVE-2026-64192](https://patchblox.com/security/data/cve/CVE-2026-64192.md) | High | bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized | 7.8 | 0.0012 |  |
| [CVE-2026-74564](https://patchblox.com/security/data/cve/CVE-2026-74564.md) | High | netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH | 7.1 | 0.0012 |  |
| [CVE-2026-74583](https://patchblox.com/security/data/cve/CVE-2026-74583.md) | High | net/sched: cls_route: fix fastmap use-after-free on filter | 8.8 | 0.0012 |  |
| [CVE-2026-74563](https://patchblox.com/security/data/cve/CVE-2026-74563.md) | High | rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() | 7.8 | 0.0012 |  |
| [CVE-2026-74567](https://patchblox.com/security/data/cve/CVE-2026-74567.md) | High | keys: fix out-of-bounds read in keyring_get_key_chunk() | 7.1 | 0.0012 |  |
| [CVE-2026-74595](https://patchblox.com/security/data/cve/CVE-2026-74595.md) | High | fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() | 7.8 | 0.0009 |  |
| [CVE-2026-80726](https://patchblox.com/security/data/cve/CVE-2026-80726.md) | High | KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page | 9.3 | n/a |  |
| [CVE-2026-68277](https://patchblox.com/security/data/cve/CVE-2026-68277.md) | Routine | drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers | 5.5 | 0.0022 |  |
| [CVE-2026-68184](https://patchblox.com/security/data/cve/CVE-2026-68184.md) | Routine | cdrom: fix stack out-of-bounds read in CDROMVOLCTRL | 5.5 | 0.0022 |  |
| [CVE-2026-68313](https://patchblox.com/security/data/cve/CVE-2026-68313.md) | Routine | tipc: fix infinite loop in __tipc_nl_compat_dumpit | 5.5 | 0.0022 |  |
| [CVE-2026-68322](https://patchblox.com/security/data/cve/CVE-2026-68322.md) | Routine | rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled | 5.5 | 0.0022 |  |
| [CVE-2026-72096](https://patchblox.com/security/data/cve/CVE-2026-72096.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  dm-verity: make error counter atomic  The error... | 5.5 | 0.0022 |  |
| [CVE-2026-72117](https://patchblox.com/security/data/cve/CVE-2026-72117.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  can: bcm: fix data race on rx_stamp/rx_ifindex i... | 5.5 | 0.0022 |  |
| [CVE-2026-72118](https://patchblox.com/security/data/cve/CVE-2026-72118.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  can: bcm: fix CAN frame rx/tx statistics  KCSAN... | 5.5 | 0.0022 |  |
| [CVE-2026-72392](https://patchblox.com/security/data/cve/CVE-2026-72392.md) | Routine | ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump | 5.5 | 0.0022 |  |
| [CVE-2026-68164](https://patchblox.com/security/data/cve/CVE-2026-68164.md) | Routine | mm/damon/core: disallow overlapping input ranges for damon_set_regions() | 5.5 | 0.0022 |  |
| [CVE-2026-68422](https://patchblox.com/security/data/cve/CVE-2026-68422.md) | Routine | btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() | 5.5 | 0.0022 |  |
| [CVE-2026-72413](https://patchblox.com/security/data/cve/CVE-2026-72413.md) | Routine | sctp: fix err_chunk memory leaks in INIT handling | 5.9 | 0.0021 |  |
| [CVE-2026-68386](https://patchblox.com/security/data/cve/CVE-2026-68386.md) | Routine | bpf, sockmap: Reject unhashed UDP sockets on sockmap update | 5.5 | 0.0021 |  |
| [CVE-2026-72040](https://patchblox.com/security/data/cve/CVE-2026-72040.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  ipmi: fix refcount leak in i_ipmi_request()  Whe... | 5.5 | 0.0021 |  |
| [CVE-2026-68269](https://patchblox.com/security/data/cve/CVE-2026-68269.md) | Routine | drm/i915/gem: Add missing nospec on parallel submit slot | 5.5 | 0.0021 |  |
| [CVE-2026-72030](https://patchblox.com/security/data/cve/CVE-2026-72030.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  ata: libata-core: Reject an invalid concurrent p... | 5.5 | 0.0021 |  |
| [CVE-2026-80793](https://patchblox.com/security/data/cve/CVE-2026-80793.md) | Routine | ipv4: reject undersized MTUs in ip_do_fragment() | 5.5 | 0.0020 |  |
| [CVE-2026-80781](https://patchblox.com/security/data/cve/CVE-2026-80781.md) | Routine | HID: core: fix OOB read of field->usage in hid_set_field() | 5.3 | 0.0020 |  |
| [CVE-2026-80765](https://patchblox.com/security/data/cve/CVE-2026-80765.md) | Routine | HID: hyperv: validate initial device info bounds | 4.5 | 0.0020 |  |
| [CVE-2026-80805](https://patchblox.com/security/data/cve/CVE-2026-80805.md) | Routine | xfs: validate attr entry pointer before field access | 4.4 | 0.0020 |  |
| [CVE-2026-74683](https://patchblox.com/security/data/cve/CVE-2026-74683.md) | Routine | Input: evdev - sanitize event type index when fetching event masks | 5.5 | 0.0019 |  |
| [CVE-2026-68279](https://patchblox.com/security/data/cve/CVE-2026-68279.md) | Routine | drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers | 5.5 | 0.0018 |  |
| [CVE-2026-80888](https://patchblox.com/security/data/cve/CVE-2026-80888.md) | Routine | drm/vmwgfx: drop dma_buf reference on foreign-fd prime import | 5.5 | 0.0018 |  |
| [CVE-2026-80890](https://patchblox.com/security/data/cve/CVE-2026-80890.md) | Routine | sctp: reject stale cookies with mismatched verification tags | 4.8 | 0.0018 |  |
| [CVE-2026-80918](https://patchblox.com/security/data/cve/CVE-2026-80918.md) | Routine | HID: core: fix number/pointer type confusion on long items | 3.3 | 0.0018 |  |
| [CVE-2026-68336](https://patchblox.com/security/data/cve/CVE-2026-68336.md) | Routine | bonding: fix devconf_all NULL dereference when IPv6 is disabled | 5.5 | 0.0018 |  |
| [CVE-2026-74464](https://patchblox.com/security/data/cve/CVE-2026-74464.md) | Routine | net: openvswitch: fix skb leak on flow key update failure during ct | 5.5 | 0.0018 |  |
| [CVE-2026-74487](https://patchblox.com/security/data/cve/CVE-2026-74487.md) | Routine | binfmt_misc: restore write access when removing an entry | 5.5 | 0.0018 |  |
| [CVE-2026-74620](https://patchblox.com/security/data/cve/CVE-2026-74620.md) | Routine | net/sched: act_gact, act_police: range check the fallback control action | 5.5 | 0.0018 |  |
| [CVE-2026-74654](https://patchblox.com/security/data/cve/CVE-2026-74654.md) | Routine | serial: 8250_dma: Clear stale RX state on shutdown | 5.5 | 0.0018 |  |
| [CVE-2026-74657](https://patchblox.com/security/data/cve/CVE-2026-74657.md) | Routine | ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops | 5.5 | 0.0018 |  |
| [CVE-2026-74658](https://patchblox.com/security/data/cve/CVE-2026-74658.md) | Routine | futex: Prevent robust futex exit race some more | 5.5 | 0.0018 |  |
| [CVE-2026-74664](https://patchblox.com/security/data/cve/CVE-2026-74664.md) | Routine | net: openvswitch: reallocate update replies for mismatched IDs | 5.5 | 0.0018 |  |
| [CVE-2026-74671](https://patchblox.com/security/data/cve/CVE-2026-74671.md) | Routine | ima: fix out-of-bounds read in xattr_verify() | 5.5 | 0.0018 |  |
| [CVE-2026-74673](https://patchblox.com/security/data/cve/CVE-2026-74673.md) | Routine | Input: evdev - fix information leak in evdev_pass_values() | 5.5 | 0.0018 |  |
| [CVE-2026-74676](https://patchblox.com/security/data/cve/CVE-2026-74676.md) | Routine | vt: add permission check for KDSKBMETA ioctl | 5.5 | 0.0018 |  |
| [CVE-2026-80534](https://patchblox.com/security/data/cve/CVE-2026-80534.md) | Routine | xfs: fix ilock leak on error in xfs_dq_get_next_id | 5.5 | 0.0018 |  |
| [CVE-2026-80733](https://patchblox.com/security/data/cve/CVE-2026-80733.md) | Routine | net: remove WARN_ON_ONCE() from sk_mc_loop() | 5.5 | 0.0018 |  |
| [CVE-2026-80742](https://patchblox.com/security/data/cve/CVE-2026-80742.md) | Routine | af_packet: Don't send zero-byte data in tpacket_snd(). | 5.5 | 0.0018 |  |
| [CVE-2026-80744](https://patchblox.com/security/data/cve/CVE-2026-80744.md) | Routine | netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path | 3.3 | 0.0018 |  |
| [CVE-2026-80529](https://patchblox.com/security/data/cve/CVE-2026-80529.md) | Routine | xfs: don't swallow dquot recovery verification errors | 6.3 | 0.0017 |  |
| [CVE-2026-64542](https://patchblox.com/security/data/cve/CVE-2026-64542.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  ipv6: ndisc: fix NULL deref in accept_untracked_... | 5.5 | 0.0017 |  |
| [CVE-2026-68243](https://patchblox.com/security/data/cve/CVE-2026-68243.md) | Routine | drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU | 5.5 | 0.0017 |  |
| [CVE-2026-68244](https://patchblox.com/security/data/cve/CVE-2026-68244.md) | Routine | drm/i915/gem: Do not leak siblings[] on proto context error | 5.5 | 0.0017 |  |
| [CVE-2026-68248](https://patchblox.com/security/data/cve/CVE-2026-68248.md) | Routine | drm/i915: Return NULL on error in active_instance | 5.5 | 0.0017 |  |
| [CVE-2026-68254](https://patchblox.com/security/data/cve/CVE-2026-68254.md) | Routine | drm/i915/vrr: require valid min/max vfreq for VRR | 5.5 | 0.0017 |  |
| [CVE-2026-74636](https://patchblox.com/security/data/cve/CVE-2026-74636.md) | Routine | tracing: Fix race between update_event_fields and, event_define_fields | 5.5 | 0.0017 |  |
| [CVE-2026-74722](https://patchblox.com/security/data/cve/CVE-2026-74722.md) | Routine | btrfs: fix memory leak in btrfs_do_encoded_write() | 5.5 | 0.0017 |  |
| [CVE-2026-64579](https://patchblox.com/security/data/cve/CVE-2026-64579.md) | Routine | xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert | 5.5 | 0.0017 |  |
| [CVE-2026-80757](https://patchblox.com/security/data/cve/CVE-2026-80757.md) | Routine | selinux: reject a class permission count below its inherited common | 6.7 | 0.0017 |  |
| [CVE-2026-68428](https://patchblox.com/security/data/cve/CVE-2026-68428.md) | Routine | KVM: x86/mmu: Fix use-after-free on vendor module reload | 5.5 | 0.0017 |  |
| [CVE-2026-74566](https://patchblox.com/security/data/cve/CVE-2026-74566.md) | Routine | keys: make keyring key-chunk byte order agree with keyring_diff_objects() | 5.5 | 0.0017 |  |
| [CVE-2026-74577](https://patchblox.com/security/data/cve/CVE-2026-74577.md) | Routine | net: mpls: initialize rtm_tos in mpls_getroute() | 5.5 | 0.0017 |  |
| [CVE-2026-80756](https://patchblox.com/security/data/cve/CVE-2026-80756.md) | Routine | selinux: do not cancel a policy conversion that never started | 4.4 | 0.0017 |  |
| [CVE-2026-80906](https://patchblox.com/security/data/cve/CVE-2026-80906.md) | Routine | net: packet: fix wrong transport_header when sending VLAN-tagged frame | 4.4 | 0.0017 |  |
| [CVE-2026-80913](https://patchblox.com/security/data/cve/CVE-2026-80913.md) | Routine | selinux: require every boolean value to be defined | 4.4 | 0.0017 |  |
| [CVE-2026-80917](https://patchblox.com/security/data/cve/CVE-2026-80917.md) | Routine | PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems | 4.1 | 0.0017 |  |
| [CVE-2026-68450](https://patchblox.com/security/data/cve/CVE-2026-68450.md) | Routine | btrfs: free mapping node on duplicate reloc root insert | 5.5 | 0.0016 |  |
| [CVE-2026-80901](https://patchblox.com/security/data/cve/CVE-2026-80901.md) | Routine | ipvs: fix the checksum validations | 5.3 | 0.0016 |  |

---

Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.