---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux kernel versions prior to 5.10.258, 5.15.209, and 6.1.175
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Use-After-Free (UAF) vulnerability exists in the Linux kernel Bluetooth bnep driver, caused by improper synchronization when reading device names, potentially allowing for arbitrary code execution.

Executive Summary:
A Use-After-Free vulnerability in the Bluetooth bnep driver allows an adjacent attacker to potentially execute arbitrary code or cause a system crash.

Vulnerability Details

CVE-ID: CVE-2026-64178

Affected Software: Linux Kernel

Affected Versions: Versions prior to 5.10.258, 5.15.209, and 6.1.175

Vulnerability: The bnep_add_connection function fails to properly hold the bnep_session_sem semaphore while accessing device names. An unauthenticated attacker within Bluetooth range can trigger a race condition that frees the net_device, resulting in a use-after-free scenario.

Business Impact

An attacker in proximity to the target system can exploit this vulnerability to crash the kernel or gain elevated privileges. Given the CVSS score of 8.8, this presents a significant risk to mobile devices, workstations, and IoT hardware that utilize Bluetooth networking, potentially leading to total system compromise.

Remediation Plan

Immediate Action: Update the Linux kernel to version 5.10.258, 5.15.209, 6.1.175, or later.

Proactive Monitoring: Review Bluetooth connection logs for unusual activity or frequent interface resets, which may indicate exploitation attempts.

Compensating Controls: Disable Bluetooth interfaces on critical systems where wireless connectivity is not required to eliminate the attack vector.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The race condition is specific to the bnep driver and requires precise timing by an attacker.

Analyst Recommendation

This vulnerability poses a high risk to systems with active Bluetooth capabilities. System administrators should prioritize applying kernel security patches, particularly on devices that are frequently exposed to public or untrusted wireless environments.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 3592c0083fb29cca13cd9978b8844d58b4eff548 up to (excluding) 6.18
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Linux kernel iwlwifi driver improperly handles transmission rates on legacy devices, potentially leading to information disclosure or denial of service.

Executive Summary:
An improper handling of transmission rates in the Linux kernel iwlwifi driver exposes legacy devices to potential information disclosure and denial of service attacks.

Vulnerability Details

CVE-ID: CVE-2026-64176

Affected Software: Linux Kernel

Affected Versions: 3592c0083fb29cca13cd9978b8844d58b4eff548 up to (excluding) 6.18

Vulnerability: This issue exists in the iwlwifi driver, specifically within the MVM layer, where TX rates for legacy devices are encoded incorrectly. An adjacent attacker can leverage this miscalculation to trigger undefined behavior in the wireless stack.

Business Impact

This vulnerability could be exploited by an attacker in physical proximity to the wireless network to crash the driver, resulting in a denial of service for affected systems. Furthermore, the improper rate handling may potentially lead to the disclosure of sensitive wireless traffic data. With a CVSS score of 8.1, this flaw presents a substantial risk to wireless infrastructure stability and data privacy.

Remediation Plan

Immediate Action: Update the Linux kernel to version 6.18.34, 7.0.11, or later versions where this driver defect is resolved.

Proactive Monitoring: Monitor system logs for repeated wireless driver crashes, kernel panics, or unusual activity associated with the iwlwifi module.

Compensating Controls: Disable wireless interfaces on affected hardware if immediate patching is not feasible and the risk of adjacent exploitation is deemed high.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherent to the driver's handling of legacy hardware protocols.

Analyst Recommendation

System administrators should prioritize patching the Linux kernel to the identified fixed versions. Given the nature of kernel-level vulnerabilities, applying these updates is essential to maintain system stability and prevent potential exploitation by adjacent attackers.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux kernel versions prior to 5.15.209, 6.1.175, 6.6.142, and 6.12.92
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A local privilege escalation vulnerability exists in the Linux kernel drm/msm driver due to an incorrect return value check in iommu_map_sgtable, potentially leading to system instability or compromise.

Executive Summary:
A flaw in the Linux kernel drm/msm driver allows a local, authenticated attacker to trigger memory management errors, resulting in potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-64153

Affected Software: Linux Kernel

Affected Versions: Versions prior to 5.15.209, 6.1.175, 6.6.142, and 6.12.92

Vulnerability: This is a memory management vulnerability involving the drm/msm driver. An attacker with local, low-privileged access can leverage the incorrect return value handling in iommu_map_sgtable to cause system-wide impacts.

Business Impact

Successful exploitation allows a local user to escalate privileges or cause a kernel panic, leading to denial of service or unauthorized system access. With a CVSS score of 8.8, this vulnerability represents a high risk to infrastructure integrity and uptime, particularly in multi-tenant environments or systems where local user access is permitted.

Remediation Plan

Immediate Action: Update the Linux kernel to version 5.15.209, 6.1.175, 6.6.142, 6.12.92, or later as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel-related warnings or unexpected system reboots, which may indicate attempts to trigger this or similar memory faults.

Compensating Controls: Restrict local shell access to untrusted users and enforce strict kernel module loading policies to reduce the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by a local attacker capable of interacting with the drm/msm subsystem.

Analyst Recommendation

Given the high CVSS score and the critical nature of kernel-level vulnerabilities, organizations should prioritize patching affected systems during the next maintenance window. Apply the provided kernel updates immediately to mitigate the risk of local privilege escalation and system instability.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 6.19
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A flaw in the Linux kernel IOMMU implementation allows for improper page size handling, potentially leading to memory access issues.

Executive Summary:
An IOMMU configuration error in the Linux kernel could allow a local attacker with low privileges to trigger memory corruption or unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-64151

Affected Software: Linux Kernel

Affected Versions: 6.19

Vulnerability: The vulnerability exists in the iommupt driver due to a failure to validate PAGE_SIZE within the pgsize_bitmap. An authenticated local attacker with low privileges could exploit this to manipulate memory mappings, leading to significant system compromise.

Business Impact

The potential for unauthorized memory access or corruption poses a severe threat to data confidentiality and integrity. With a CVSS score of 8.4, this vulnerability is considered high risk, as it allows for privilege escalation or cross-domain memory access in virtualized or containerized environments.

Remediation Plan

Immediate Action: Update the Linux kernel to version 7.0.11 or later to incorporate the necessary validation checks.

Proactive Monitoring: Implement kernel auditing to detect unusual memory mapping requests or unauthorized attempts to manipulate IOMMU settings.

Compensating Controls: Utilize hardware-based security features, such as Intel VT-d or AMD-Vi, and enforce strict container isolation policies to limit the scope of impact.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is a result of logic errors in memory management during IOMMU initialization.

Analyst Recommendation

Due to the potential for privilege escalation and memory corruption, this update is critical. Organizations should verify their kernel versions and apply the recommended patches immediately to maintain the security posture of their infrastructure.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel (ksmbd)
AFFECTED_VERSIONS: 5.15 and later, up to kernels preceding 6.12.92, 6.18.34, and 7.0.11
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The ksmbd server in the Linux kernel fails to properly validate Security Identifier (SID) data during ACL inheritance, leading to potential security bypasses.

Executive Summary:
A high-severity vulnerability in the Linux kernel ksmbd implementation could allow an authenticated remote attacker to bypass access control restrictions through malformed security descriptors.

Vulnerability Details

CVE-ID: CVE-2026-64138

Affected Software: Linux Kernel (ksmbd)

Affected Versions: 5.15 and later, up to kernels preceding 6.12.92, 6.18.34, and 7.0.11

Vulnerability: This vulnerability occurs within the ksmbd kernel-mode SMB server, where the lack of validation for Owner and Group SIDs during ACL inheritance allows for improper security descriptor processing. An authenticated attacker can exploit this to manipulate file permissions.

Business Impact

By bypassing access control lists, an attacker could gain unauthorized access to sensitive files or modify system configurations. With a CVSS score of 8.8, this vulnerability is critical for organizations relying on ksmbd for file sharing, as it directly undermines the confidentiality and integrity of the stored data.

Remediation Plan

Immediate Action: Update the Linux kernel to version 6.12.92, 6.18.34, 7.0.11, or later.

Proactive Monitoring: Review SMB server access logs for unusual ACL modification requests or unauthorized attempts to access protected directories.

Compensating Controls: Utilize a dedicated SMB gateway or firewall rules to restrict access to the SMB service to authorized clients only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The need for authentication limits the exploitability to established network users.

Analyst Recommendation

Organizations deploying the ksmbd server must prioritize this update to prevent potential privilege escalation and unauthorized data access. Ensure that all kernel-level SMB services are patched to the recommended versions to maintain robust access control enforcement.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux kernels bd61848900bff597764238f3a8ec67c815cd316e up to 6.16
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A boundary checking error in the Linux kernel network devmem implementation allows for out-of-bounds access during dma-buf binding.

Executive Summary:
A boundary checking vulnerability in the Linux kernel network devmem subsystem could allow a local attacker to achieve privilege escalation or system compromise.

Vulnerability Details

CVE-ID: CVE-2026-64124

Affected Software: Linux Kernel

Affected Versions: Linux kernels bd61848900bff597764238f3a8ec67c815cd316e up to 6.16

Vulnerability: The net_devmem_bind_dmabuf function fails to properly validate page-aligned sizes, leading to out-of-bounds indexing in the tx_vec structure. This vulnerability requires low privileges (authenticated) to execute.

Business Impact

The CVSS score of 8.8 reflects the high potential for full system compromise, including the ability to break out of containers or gain elevated privileges. This poses a severe risk to multi-tenant environments and secure system boundaries.

Remediation Plan

Immediate Action: Update the Linux kernel to version 6.18.35, 7.0.11, 7.1, or later, as recommended by the upstream fix.

Proactive Monitoring: Monitor for suspicious system calls related to dma-buf or network memory operations that deviate from standard baseline behavior.

Compensating Controls: Use kernel hardening features such as restricting access to sensitive network features and implementing strict container security policies (e.g., seccomp profiles).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw involves complex interaction with hardware-backed memory buffers.

Analyst Recommendation

Due to the high severity and potential for privilege escalation, patching is the highest priority. Administrators must ensure all production kernels are updated to the secure versions listed to mitigate the risk of local exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 4.4 and various versions up to 6.1.175
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A memory management flaw exists in the Linux kernel qed driver, where an improper error handling path leads to a double free condition during CID bitmap allocation failures.

Executive Summary:
A double free vulnerability in the Linux kernel qed driver could allow a local attacker to cause system instability or potential memory corruption.

Vulnerability Details

CVE-ID: CVE-2026-64118

Affected Software: Linux Kernel

Affected Versions: 4.4 and various versions up to 6.1.175

Vulnerability: This is a double free vulnerability located in the qed_cxt_tables_alloc function. The flaw is triggered during error recovery when CID bitmap allocations fail, allowing an unauthenticated local attacker to potentially cause a kernel panic or exploit memory state.

Business Impact

Successful exploitation of this vulnerability could lead to a denial of service through kernel crashes, which disrupts critical business operations. Given the CVSS score of 8.4, this vulnerability represents a high risk to system availability and integrity, particularly in environments relying on the qed driver for network infrastructure.

Remediation Plan

Immediate Action: Update the Linux kernel to version 5.10.259, 5.15.210, 6.1.175, or 6.6.142, or apply the relevant upstream patches.

Proactive Monitoring: Monitor system logs for kernel oops or panic messages that may indicate memory management errors or attempted exploitation.

Compensating Controls: Restrict local user access to the system to reduce the attack surface, as local execution is required to trigger this flaw.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherent to the error handling logic of the driver code.

Analyst Recommendation

This vulnerability presents a significant risk to system stability and should be addressed promptly. Administrators are advised to prioritize the application of kernel security patches in all affected environments to prevent potential denial of service attacks.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 6.4 and later, up to kernels preceding 7.0.11
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A race condition in the Linux kernel mac80211 wifi stack leads to memory corruption when capturing RX rates during mesh data processing.

Executive Summary:
A high-severity memory corruption vulnerability in the Linux kernel mac80211 subsystem could allow an adjacent attacker to crash the system or achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-64117

Affected Software: Linux Kernel

Affected Versions: 6.4 and later, up to kernels preceding 7.0.11

Vulnerability: The vulnerability exists in the mac80211 subsystem where ieee80211_invoke_fast_rx reads RX status from the socket buffer control block, which is subsequently overwritten by ieee80211_rx_mesh_data. This race condition allows for memory corruption and requires an attacker to be within the local network range (adjacent access).

Business Impact

The ability to trigger memory corruption via the network stack poses a severe risk to network-connected devices. Given the CVSS score of 8.8, this vulnerability could be exploited to compromise the integrity and availability of wireless-enabled Linux infrastructure, potentially leading to full system compromise.

Remediation Plan

Immediate Action: Update the Linux kernel to version 7.0.11 or later, or apply the relevant distribution-provided security patches.

Proactive Monitoring: Monitor network-related kernel events and crash reports, specifically those involving wireless mesh networking drivers.

Compensating Controls: If patching is delayed, minimize the exposure of mesh-enabled wireless interfaces to untrusted networks using network segmentation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of triggering race conditions in the wireless stack typically requires specific environmental conditions.

Analyst Recommendation

Given the potential for remote-adjacent compromise of the kernel, immediate remediation is required. Organizations utilizing wireless mesh networking on Linux should verify their kernel versions and apply the necessary updates to mitigate this high-risk memory safety flaw.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 3.9 and later, up to kernels preceding 5.10.258, 5.15.209, 6.1.175, and 6.6.142
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Linux kernel vsock/vmci implementation occurs when a peer resets a connection during the handshake process.

Executive Summary:
A high-severity use-after-free vulnerability in the Linux kernel vsock/vmci subsystem could allow a local attacker to cause a kernel crash or potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-64115

Affected Software: Linux Kernel

Affected Versions: 3.9 and later, up to kernels preceding 5.10.258, 5.15.209, 6.1.175, and 6.6.142

Vulnerability: This is a use-after-free flaw within the vsock/vmci transport layer, triggered by improper handling of connection resets during the handshake. The vulnerability requires a local attacker with low privileges to interact with the vsock interface.

Business Impact

Successful exploitation of this vulnerability allows a local user to escalate privileges or cause a system-wide denial of service by crashing the kernel. With a CVSS score of 8.8, this flaw represents a significant risk to system stability and data integrity, particularly in multi-tenant environments where local access is provided to untrusted users.

Remediation Plan

Immediate Action: Update the Linux kernel to version 5.10.258, 5.15.209, 6.1.175, 6.6.142, or later as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or panic messages related to vsock or vmci operations.

Compensating Controls: Restrict access to virtual machine communication interfaces if they are not required for system operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for kernel memory corruption.

Analyst Recommendation

This vulnerability presents a high risk to Linux-based systems. Administrators should prioritize patching the kernel across all affected environments, particularly on servers that support local user shell access or virtualization workloads, to prevent potential privilege escalation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 2b514574f7e88c8498027ee366fd6e7aae5aa4b5 up to (excluding) 26342087fac93b3932e6af61dc91ec029cb8a623 and related branches
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Linux kernel af_unix implementation allows local users to trigger a race condition in unix_stream_data_wait, potentially leading to privilege escalation.

Executive Summary:
A high-severity use-after-free vulnerability in the Linux kernel af_unix component could allow a local attacker to escalate privileges or crash the system.

Vulnerability Details

CVE-ID: CVE-2026-64109

Affected Software: Linux Kernel

Affected Versions: 2b514574f7e88c8498027ee366fd6e7aae5aa4b5 up to (excluding) 26342087fac93b3932e6af61dc91ec029cb8a623, 38bccb927d83d7d52e5b20015a172a0b6101d11e, acdff9907478e82208475b1151700d0b71dcdc63, 5f162f95a95834f06a8ec6140889272ad12e842f, and be309f8eae8b474a4a617eaae01324da996fc719.

Vulnerability: The unix_stream_data_wait function performs an unsafe read on the receive queue without proper locking. This allows a local authenticated user to trigger a race condition, leading to a use-after-free read.

Business Impact

The CVSS score of 8.8 highlights the high risk associated with this local privilege escalation vector. A successful exploit grants the attacker full control over the affected system, making this a critical concern for multi-user environments.

Remediation Plan

Immediate Action: Update the Linux kernel to version 6.6.143, 6.12.92, 6.18.34, 7.0.11, or newer as provided by your distribution vendor.

Proactive Monitoring: Monitor for suspicious local activity, such as unexpected process crashes or attempts to access restricted memory regions by non-privileged users.

Compensating Controls: Where patching is delayed, minimize the number of users with local shell access and utilize security modules like SELinux or AppArmor to restrict process capabilities.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While local in nature, the impact of privilege escalation makes this a significant risk.

Analyst Recommendation

Local privilege escalation vulnerabilities are often utilized in post-exploitation scenarios. It is highly recommended to apply the kernel patch immediately to prevent unauthorized escalation of privileges on your Linux infrastructure.

---METADATA---
VENDOR: Linux
PRODUCT: Linux Kernel
AFFECTED_VERSIONS: 3e385c0d6ce88ac9916dcf84267bd5855d830748 up to 6.14
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Linux kernel's SEV-guest driver causes improper page state handling during memory encryption failures, potentially leading to information disclosure or system instability.

Executive Summary:
A high-severity memory management vulnerability in the Linux kernel's SEV-guest driver could be exploited by local attackers to cause information disclosure or system-wide impact.

Vulnerability Details

CVE-ID: CVE-2026-64104

Affected Software: Linux Kernel

Affected Versions: 3e385c0d6ce88ac9916dcf84267bd5855d830748 up to 6.14; fixed in 6.18.34 and 7.0.11

Vulnerability: This issue occurs within the virt/sev-guest driver where failed calls to memory management functions leave pages in an unknown state. A local attacker with low privileges could leverage this state inconsistency to gain unauthorized access or influence system operations.

Business Impact

The CVSS score of 8.7 reflects the potential for local privilege escalation and system impact within virtualized environments. Compromise of the kernel memory state can lead to the bypass of security boundaries, resulting in unauthorized data access and potential disruption of critical virtualized services.

Remediation Plan

Immediate Action: Update the Linux kernel to a patched version, specifically 6.18.34, 7.0.11, or newer releases as provided by the distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panic events or unusual memory management errors that may indicate an attempt to trigger this vulnerability.

Compensating Controls: Restrict local user access to the system and minimize the use of untrusted virtualized workloads that interact directly with the SEV-guest interface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is complex and requires specific local access to trigger the memory state error.

Analyst Recommendation

Given the central role of the kernel in system security, organizations should treat this update with high urgency. Patching the kernel is the only definitive way to resolve the underlying memory management defect and protect against potential local exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: ab49886e3da73b6b35ece21006e191910427bb30 up to (excluding) ff3a4487ead475e27b43280b8ee3d8464fe280e1 and related branches
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability exists in the Linux kernel batman-adv multicast component, caused by incorrect RCU grace period handling during entry purging.

Executive Summary:
A high-severity use-after-free vulnerability in the Linux kernel batman-adv module may allow an adjacent attacker to compromise system stability or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-64096

Affected Software: Linux Kernel

Affected Versions: ab49886e3da73b6b35ece21006e191910427bb30 up to (excluding) ff3a4487ead475e27b43280b8ee3d8464fe280e1, 78a63fb2f7d5630d1c1f2859a20d4e4226863b41, ced48f55bac73f0822eae90509e51b42b4f646c8, 70bcb678561f0fb58f33270fc73f12f3be72b878, aef897c9d2dd0d9339167fb82b62beff68d076cb, 8a3707653ab658e082ccd992e92594e01b09a3fc, edfb1e094104a50f931553dc82ac59246569fd32, and 20c2d6a20ca936f5aaa6dd40f73f262ac45c87cc.

Vulnerability: The batadv_mcast_purge_orig function fails to wait for an RCU grace period after removing entries, leading to a use-after-free condition. The attacker must have adjacent network access to reach the vulnerable code path.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to system security. Exploitation could lead to arbitrary code execution with kernel privileges, resulting in a total compromise of the affected host.

Remediation Plan

Immediate Action: Update the Linux kernel to version 5.10.258, 5.15.209, 6.1.175, 6.6.142, or newer as provided by your distribution vendor.

Proactive Monitoring: Monitor kernel ring buffers and logs for segmentation faults or memory access violations that could indicate an attempted exploit.

Compensating Controls: Disable the batman-adv module if not explicitly required by your network architecture to eliminate the attack surface entirely.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Use-after-free vulnerabilities in the kernel are inherently dangerous, but they require precise timing to exploit successfully.

Analyst Recommendation

This vulnerability should be treated with high urgency. Administrators should verify their kernel versions against the provided fixed releases and apply patches as part of an emergency update cycle where feasible.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e up to (excluding) 00bf4bb9947b1190a8be8d9b6a1bcbfa3707785c and related branches
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A race condition in the Linux kernel batman-adv module's tp_meter functionality allows for improper timer cleanup, potentially leading to memory corruption or system instability.

Executive Summary:
A high-severity vulnerability in the Linux kernel batman-adv module could allow an adjacent attacker to trigger a denial of service or potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-64093

Affected Software: Linux Kernel

Affected Versions: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e up to (excluding) 00bf4bb9947b1190a8be8d9b6a1bcbfa3707785c, 74a76634055462833446684fd526d73c290ea43a, 5bc2d50fb66b46f86543d5153a188eb1486d0b6e, f86b20ec8d17d77bddc02c5c86cfa2389d84ecff, 770bf0a35f0620b526fd4193889d1e77084e4c43, 933880a8bc9b4042223a79255c0b1021cdc36991, and d5487249a81ea658717614009c8f46acc5b7101a.

Vulnerability: The batadv_tp_sender_cleanup function fails to synchronize timer deletion correctly, allowing the timer to re-arm during cleanup. This is an unauthenticated vulnerability requiring adjacent network access.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high risk to system availability and integrity. Successful exploitation could result in kernel-level crashes, leading to significant service disruption and potential unauthorized system modification.

Remediation Plan

Immediate Action: Update the Linux kernel to version 5.15.210, 6.1.176, 6.6.143, 6.12.93, or newer as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panics or batman-adv related errors that may indicate exploitation attempts.

Compensating Controls: Restrict network access to the batman-adv protocol to trusted interfaces only, reducing the attack surface for adjacent network threats.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is rooted in kernel-level race conditions which are typically complex to weaponize reliably.

Analyst Recommendation

Given the high CVSS score and the critical nature of the Linux kernel, organizations should prioritize patching this issue during their next maintenance cycle. Ensure that all kernel updates are tested in a staging environment before deployment to production systems.

---METADATA---
VENDOR: Linux
PRODUCT: Linux Kernel
AFFECTED_VERSIONS: 3.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The batman-adv protocol in the Linux kernel contains a vulnerability where the tt_buff_len field is incorrectly declared as a signed integer, potentially causing issues with negative values.

Executive Summary:
An integer handling flaw in the Linux kernel batman-adv protocol could lead to unexpected behavior or system compromise when processing network traffic.

Vulnerability Details

CVE-ID: CVE-2026-64088

Affected Software: Linux Kernel

Affected Versions: Versions 3.1 and various downstream branches as specified in vendor advisories.

Vulnerability: The batadv_orig_node structure uses a signed 16-bit integer for tt_buff_len, which is not intended to be negative. This vulnerability is reachable via adjacent network access.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a significant risk to network availability and system security. An attacker on the adjacent network could potentially trigger this flaw to cause a crash or gain unauthorized influence over packet processing.

Remediation Plan

Immediate Action: Update the Linux kernel to the versions specified in the stable tree (e.g., 6.1.175, 6.6.142) to ensure the integer type is corrected.

Proactive Monitoring: Observe network traffic patterns for anomalous batman-adv packets that might indicate attempted exploitation.

Compensating Controls: Use network segmentation to isolate nodes running the batman-adv protocol from untrusted or public network segments.

Exploitation Status

Public Exploit Available: Unknown. There is no confirmed public exploit in the available data.

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for adjacent network access limits the attack surface to those within physical or logical proximity to the network.

Analyst Recommendation

Although exploitation requires local network presence, the high CVSS score necessitates prompt patching. Organizations utilizing mesh networking protocols should prioritize updating their kernel versions to remediate this flaw.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 285a5ea0f542db94c3ed11e01a71abb47d15cbf5 up to 6.15 (excluding fixed)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Linux kernel's arm_ffa firmware driver lacks proper validation for framework notification message layouts, leading to potential memory corruption.

Executive Summary:
A vulnerability in the Linux kernel arm_ffa firmware driver could allow an attacker to trigger memory corruption and cause system instability or potential code execution.

Vulnerability Details

CVE-ID: CVE-2026-64081

Affected Software: Linux Kernel

Affected Versions: Versions prior to 6.18.34 and 7.0.11

Vulnerability: The arm_ffa firmware driver does not correctly validate the layout of framework notification messages within the shared RX buffer. This oversight allows for potential memory corruption when processing indirect messages.

Business Impact

Exploitation of this kernel-level vulnerability can lead to system crashes (Denial of Service) or potential privilege escalation. With a CVSS score of 8.4, it represents a high-risk scenario for any system running the affected Linux kernel versions, particularly in environments where kernel-level security is paramount.

Remediation Plan

Immediate Action: Update the Linux kernel to version 6.18.34, 7.0.11, or the latest available stable release as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panics or suspicious memory access errors that may indicate exploitation attempts.

Compensating Controls: Limit access to the system and ensure that only trusted users or processes can interact with firmware-related drivers and interfaces.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Kernel vulnerabilities of this nature are complex to exploit but offer significant rewards to an attacker, justifying a swift patching response.

Analyst Recommendation

Kernel updates are critical for maintaining system stability and security. Administrators should schedule and perform the necessary kernel updates to 6.18.34 or 7.0.11 immediately to protect against potential memory corruption attacks.

---METADATA---
VENDOR: Docker
PRODUCT: Docker Desktop
AFFECTED_VERSIONS: 4.41.0 up to (excluding) 4.59.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Docker CLI --use-api-socket flag allows local users to bypass Enhanced Container Isolation (ECI) restrictions in Docker Desktop.

Executive Summary:
A vulnerability in the Docker CLI allows local attackers to bypass Enhanced Container Isolation, potentially leading to a full compromise of the container environment.

Vulnerability Details

CVE-ID: CVE-2026-6406

Affected Software: Docker Desktop

Affected Versions: 4.41.0 up to (excluding) 4.59.0

Vulnerability: This is an incorrect authorization vulnerability (CWE-863) where the --use-api-socket flag permits a local user with low privileges to circumvent security isolation mechanisms in Docker Desktop.

Business Impact

Successful exploitation allows an attacker to break out of intended container isolation boundaries, potentially leading to unauthorized access to the host system or other containers. Given the CVSS score of 8.8, this represents a significant risk to the integrity and confidentiality of the development and production environments, necessitating prioritized remediation.

Remediation Plan

Immediate Action: Update Docker Desktop to version 4.59.0 or later as specified in the vendor release notes.

Proactive Monitoring: Review local host access logs and container management logs for suspicious usage of the --use-api-socket flag by unauthorized service accounts or users.

Compensating Controls: Restrict access to the Docker CLI to authorized personnel only and implement robust host-level monitoring to detect unauthorized attempts to escalate privileges within the container runtime environment.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is locally exploitable, requiring an attacker to already have a foothold on the system to leverage the CLI flag.

Analyst Recommendation

The risk posed by this authorization bypass is severe for environments relying on ECI for security segmentation. Organizations should treat this as a high-priority update and ensure all Docker Desktop installations are patched to version 4.59.0 to restore the integrity of the container isolation model.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 11851cbd60ea1e5abbd97619d69845ead99303d6 up to 6.16
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A race condition in the Linux kernel ovpn TCP implementation allows for improper memory handling during socket closure.

Executive Summary:
A vulnerability in the Linux kernel ovpn TCP component could lead to memory corruption and potential system instability due to improper peer pointer handling.

Vulnerability Details

CVE-ID: CVE-2026-64045

Affected Software: Linux Kernel

Affected Versions: 11851cbd60ea1e5abbd97619d69845ead99303d6 up to 6.16

Vulnerability: This is a race condition vulnerability within the ovpn_tcp_close function, where the kernel improperly handles cached peer pointers after dropping the RCU read lock. The attacker requires no authentication to trigger this condition if they can interact with the affected networking stack.

Business Impact

Successful exploitation of this kernel vulnerability could lead to a system crash, resulting in significant service downtime. Given the CVSS score of 8.4, this is a High severity issue that, while requiring local interaction or specific network conditions, poses a substantial risk to the integrity and availability of critical infrastructure.

Remediation Plan

Immediate Action: Update the Linux kernel to version 6.18.34, 7.0.11, or 7.1 and later, as these versions contain the necessary security fixes.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected process terminations associated with the networking subsystem.

Compensating Controls: Limit access to the network interfaces and services that utilize the ovpn module to trusted entities only.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherent to complex memory management routines in the kernel networking stack.

Analyst Recommendation

System administrators must prioritize patching the kernel to the specified fixed versions to eliminate this race condition. Given the nature of kernel-level vulnerabilities, applying these updates is the only robust method to prevent potential denial of service or instability.