---METADATA---
VENDOR: Linux
PRODUCT: Linux Kernel
AFFECTED_VERSIONS: 5d74781ebc86c5fa9e9d6934024c505412de9b52 up to (excluding) 8443cd4497a4498c4b01058d76a92116244cb605
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Linux kernel vfio/pci driver allows improper export of DMABUF objects without verifying that BAR resources are correctly reserved.

Executive Summary:
A vulnerability in the Linux kernel vfio/pci driver allows improper access to BAR resources, which could lead to privilege escalation or system instability.

Vulnerability Details

CVE-ID: CVE-2026-64042

Affected Software: Linux Kernel

Affected Versions: Versions starting from 5d74781ebc86c5fa9e9d6934024c505412de9b52, fixed in 7.0.11 and later.

Vulnerability: The vfio/pci subsystem fails to verify that Base Address Register (BAR) resources are reserved before exporting them as a DMABUF. This requires local, authenticated access to trigger the flaw.

Business Impact

This vulnerability carries a CVSS score of 8.8, reflecting its potential for complete system compromise. By exploiting this flaw, a local attacker could gain unauthorized control over hardware resources, leading to potential privilege escalation and total system impact.

Remediation Plan

Immediate Action: Update the Linux kernel to version 7.0.11 or later, or apply the relevant upstream patches.

Proactive Monitoring: Monitor system logs for kernel-level faults or unauthorized attempts to interface with the vfio/pci subsystem.

Compensating Controls: Restrict access to device nodes associated with vfio/pci to only essential, highly trusted user accounts.

Exploitation Status

Public Exploit Available: Unknown. There is no confirmed public exploit in the available data.

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires local access, which mitigates the risk for systems not exposed to untrusted users.

Analyst Recommendation

Kernel vulnerabilities of this nature present a significant risk to system integrity. Administrators should plan to patch the affected systems as part of their next scheduled maintenance cycle or sooner if the environment supports untrusted local users.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux kernel versions prior to 6.18.34 and 7.0.11
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A flaw in the Linux kernel iwlwifi MLD driver causes a TSO segmentation explosion when AMSDU is disabled, potentially leading to system instability, memory corruption, or remote code execution.

Executive Summary:
A critical vulnerability in the Linux kernel iwlwifi MLD driver exposes systems to potential remote code execution and denial of service due to improper handling of TSO segmentation.

Vulnerability Details

CVE-ID: CVE-2026-64037

Affected Software: Linux Kernel

Affected Versions: Linux kernel versions prior to 6.18.34 and 7.0.11

Vulnerability: This is a memory corruption vulnerability within the iwlwifi MLD driver triggered when AMSDU is disabled. An unauthenticated attacker can leverage this flaw to flood the transmission ring with micro-frames, resulting in a use-after-free condition in the TCP retransmit queue.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a Critical risk to business operations. Exploitation could allow an unauthenticated attacker to execute arbitrary code or cause a kernel panic, leading to full system compromise or significant service downtime. Given the core nature of the Linux kernel, this flaw poses a severe threat to the availability and integrity of any infrastructure running vulnerable versions.

Remediation Plan

Immediate Action: Update the Linux kernel to version 6.18.34, 7.0.11, or newer as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panics or unexplained crashes related to the iwlwifi driver, and implement network-level anomaly detection to identify unusual traffic patterns associated with wireless interface drivers.

Compensating Controls: While a direct kernel update is the only effective patch, organizations can limit exposure by disabling vulnerable wireless hardware or implementing strict network segmentation to restrict access to affected devices.

Exploitation Status

Public Exploit Available: No confirmed public exploit (weaponized or otherwise) is currently available for this vulnerability.

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable due to the nature of kernel-level memory corruption, necessitating swift patch deployment.

Analyst Recommendation

Due to the critical severity and the potential for remote code execution, organizations should prioritize patching their Linux kernel environments immediately. Verify your current kernel version and apply the recommended updates to version 6.18.34 or 7.0.11 to mitigate the risk of system instability and unauthorized access.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Versions prior to 6.18.34 and 7.0.11
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A local privilege escalation vulnerability exists in the Linux kernel cgroup/rstat component due to improper validation of CPU arguments.

Executive Summary:
A high-severity local privilege escalation vulnerability in the Linux kernel cgroup/rstat component allows local attackers to trigger kernel memory corruption.

Vulnerability Details

CVE-ID: CVE-2026-64036

Affected Software: Linux Kernel

Affected Versions: Versions prior to 6.18.34 and 7.0.11

Vulnerability: The flaw exists in the BPF kfunc css_rstat_updated(), which fails to validate the caller-provided CPU argument. A local attacker with specific capabilities (CAP_BPF and CAP_PERFMON) can exploit this to perform out-of-bounds writes.

Business Impact

With a CVSS score of 7.8, this vulnerability poses a significant risk for local privilege escalation. An attacker capable of executing code on the system can leverage this flaw to elevate privileges to the kernel level, resulting in full system compromise, data theft, or persistent denial of service.

Remediation Plan

Immediate Action: Update the Linux kernel to version 6.18.34, 7.0.11, or later to incorporate the necessary input validation checks.

Proactive Monitoring: Monitor for unauthorized usage of BPF and PERFMON capabilities and audit local user activity for suspicious execution patterns.

Compensating Controls: Restrict access to sensitive capabilities like CAP_BPF and CAP_PERFMON to trusted users only to minimize the local attack surface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation in the wild. Although some reports suggest an exploit exists, there is no confirmed public weaponized exploit available. The vulnerability requires local access, which significantly limits the potential attacker demographic.

Analyst Recommendation

While this is a local attack vector, the ability to achieve kernel-level execution makes it a high-priority security concern. Administrators must prioritize patching kernel instances to prevent local attackers from escalating their privileges and gaining complete control over the operating environment.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Versions prior to 6.18.34 and 7.0.11
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A memory corruption vulnerability in the Linux kernel Intel Gigabit Ethernet driver (igc) allows for potential system instability or code execution.

Executive Summary:
A critical memory corruption vulnerability in the Linux kernel igc driver, rated at 9.8 CVSS, presents a severe risk of system instability or remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-64035

Affected Software: Linux Kernel

Affected Versions: Versions prior to 6.18.34 and 7.0.11

Vulnerability: This vulnerability arises from improper initialization of transmit buffer metadata for SMD frames within the igc driver. An attacker can trigger this state over the network, leading to memory corruption during buffer cleanup operations.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. It exposes systems to potential remote code execution or complete system crashes, leading to significant service disruption and potential unauthorized access to sensitive kernel-level data.

Remediation Plan

Immediate Action: Apply the latest Linux kernel security updates, specifically ensuring the kernel is upgraded to version 6.18.34 or 7.0.11.

Proactive Monitoring: Monitor system logs for kernel panics or repeated driver-related errors that may indicate exploitation attempts.

Compensating Controls: Restrict network access to the affected hardware interfaces and implement network-level filtering to block malformed traffic if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 19, 2026, there is no public information confirming active exploitation in the wild. While external sources suggest an exploit may exist, there is no confirmed weaponized public exploit in the provided data. The flaw is technically complex but poses a severe threat to system availability.

Analyst Recommendation

This vulnerability represents a critical threat due to its potential for remote exploitation and high CVSS score. Organizations should treat this as a high-priority update to ensure kernel integrity and prevent potential system-wide compromise.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux kernel versions prior to 6.18.34 and 7.0.11
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper bounds check in the Linux kernel mac80211 wifi subsystem allows an adjacent attacker to trigger memory corruption via a specially crafted ML element.

Executive Summary:
A vulnerability in the Linux kernel mac80211 wifi subsystem allows an adjacent attacker to cause system instability or potential code execution via malformed packets.

Vulnerability Details

CVE-ID: CVE-2026-64030

Affected Software: Linux Kernel

Affected Versions: Versions prior to 6.18.34 and 7.0.11

Vulnerability: The vulnerability exists in the ieee80211_ml_epcs function, where the link_id is not correctly bounds-checked. An unauthenticated attacker within range can send a malicious PRIO_ACCESS ML element containing a zero value for link_id, leading to out-of-bounds memory access.

Business Impact

This vulnerability allows an adjacent attacker to crash the wireless stack, resulting in a denial of service, or potentially achieve arbitrary code execution. With a CVSS score of 8.8, this is a high-severity issue for any infrastructure relying on Linux-based wireless access points or client devices.

Remediation Plan

Immediate Action: Update the Linux kernel to version 6.18.34, 7.0.11, or later as specified by the vendor.

Proactive Monitoring: Monitor wireless interface logs for errors related to packet processing or unexpected driver restarts.

Compensating Controls: Utilize WPA3 or other robust link-layer encryption to mitigate the ability of unauthorized devices to inject malicious management frames.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires the attacker to be within radio range to transmit the malicious management frame.

Analyst Recommendation

Wireless infrastructure and mobile devices running affected kernel versions are at risk. Organizations should expedite the deployment of kernel updates to all wireless-enabled Linux devices to protect against potential remote exploitation.

---METADATA---
VENDOR: Davidfcarr
PRODUCT: Quick Playground
AFFECTED_VERSIONS: 0 through 1.3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Quick Playground plugin for WordPress is vulnerable to path traversal, allowing unauthenticated attackers to read sensitive files on the server.

Executive Summary:
A path traversal vulnerability in the WordPress Quick Playground plugin allows unauthenticated attackers to access arbitrary files on the hosting server.

Vulnerability Details

CVE-ID: CVE-2026-6403

Affected Software: Davidfcarr Quick Playground

Affected Versions: 0 through 1.3.3

Vulnerability: The plugin fails to properly sanitize user-supplied input, leading to an improper limitation of a pathname to a restricted directory (CWE-22). This allows an unauthenticated attacker to traverse the directory structure and read sensitive system files.

Business Impact

This vulnerability carries a CVSS score of 7.5, indicating a high severity risk. Successful exploitation grants attackers unauthorized access to sensitive information stored on the server, such as configuration files, environment variables, or other application data, which could lead to full system compromise.

Remediation Plan

Immediate Action: Update the Quick Playground plugin to version 1.3.4 or higher immediately.

Proactive Monitoring: Inspect server access logs for requests containing directory traversal patterns (e.g., "../") targeting the plugin's API or utility endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) with rules configured to block path traversal attempts and sanitize input parameters before they reach the application layer.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication required for this attack makes the plugin a high-value target for automated scanners.

Analyst Recommendation

The severity of this path traversal vulnerability necessitates immediate action. Administrators must update the Quick Playground plugin to the latest version to prevent unauthorized file access and potential data exfiltration.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 5.10.x, 5.15.x, 6.1.x, 6.6.x (as specified in fixed packages)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free race condition exists in the Linux kernel NFC LLCP connection state machine, potentially allowing local attackers to trigger memory corruption.

Executive Summary:
A race condition in the Linux kernel NFC LLCP subsystem exposes systems to potential memory corruption and unauthorized code execution.

Vulnerability Details

CVE-ID: CVE-2026-64010

Affected Software: Linux Kernel

Affected Versions: Versions prior to 5.10.259, 5.15.210, 6.1.176, and 6.6.143.

Vulnerability: This is a use-after-free vulnerability occurring in the NFC LLCP connection state machine. An attacker can trigger this condition by racing a connection acceptance packet against a socket release, which may result in the kernel operating on freed memory. The attack vector is adjacent (AV:A), meaning the attacker must be in the same network segment.

Business Impact

Successful exploitation of this flaw can lead to a kernel panic, resulting in system downtime, or potentially allow for privilege escalation and unauthorized access to sensitive data. Given the CVSS score of 8.8, this represents a high-severity risk to system integrity and availability.

Remediation Plan

Immediate Action: Update your Linux kernel to the versions listed in the OSV fixed packages (5.10.259, 5.15.210, 6.1.176, or 6.6.143) or the latest stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or crash reports that may indicate memory corruption events related to the NFC subsystem.

Compensating Controls: If patching is not immediately feasible, disable the NFC LLCP module if it is not required for system functionality to eliminate the attack surface.

Exploitation Status

Public Exploit Available: exploit_available (unknown)

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires specific timing conditions and network proximity, which somewhat limits the immediate threat landscape.

Analyst Recommendation

This vulnerability presents a significant risk to kernel stability and security. Administrators should prioritize the deployment of kernel updates as part of standard maintenance cycles, ensuring that affected systems are brought to a patched state to prevent potential exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 5.7 and subsequent versions up to identified fix thresholds
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper state management flaw in the Linux kernel Bluetooth L2CAP module allows for the retention of stale identifiers following successful ECRED reconfiguration.

Executive Summary:
A state management vulnerability in the Linux kernel Bluetooth stack may allow an unauthenticated attacker to cause memory inconsistencies by failing to clear identifiers during reconfiguration.

Vulnerability Details

CVE-ID: CVE-2026-63976

Affected Software: Linux Kernel

Affected Versions: Linux Kernel 5.7 and versions prior to 5.10.259, 5.15.210, and 6.1.176

Vulnerability: The vulnerability exists in the l2cap_ecred_reconf_rsp function, which fails to correctly clear the chan->ident field upon a successful response. An unauthenticated adjacent attacker could potentially leverage this stale state to interfere with subsequent channel operations.

Business Impact

While the primary risk is memory inconsistency, it may lead to denial of service or unpredictable behavior in the Bluetooth stack. Given the CVSS score of 8.8, this flaw constitutes a high-severity risk to system reliability and potential security bypasses in the networking layer.

Remediation Plan

Immediate Action: Update the Linux kernel to version 5.10.259, 5.15.210, 6.1.176, 6.6.143, or later.

Proactive Monitoring: Audit logs for unusual Bluetooth control traffic or repeated re-configuration requests that deviate from normal protocol behavior.

Compensating Controls: Implement physical or logical access controls to limit exposure to the Bluetooth interface on exposed hardware.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof of concept for this vulnerability. The vulnerability is a logic bug that may require precise timing of protocol messages to exploit.

Analyst Recommendation

Users should prioritize updating their Linux kernel to the latest available patched version. Regular maintenance of the kernel is essential to mitigate risks associated with the Bluetooth protocol stack, which is a frequent target for local and adjacent network attacks.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 5.7 and subsequent versions up to identified fix thresholds
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A logic error in the Linux kernel Bluetooth L2CAP implementation allows for potential crashes when processing malformed destination CID connection responses.

Executive Summary:
A memory management error in the Linux kernel L2CAP layer allows unauthenticated attackers to trigger a kernel crash via malformed Bluetooth connection packets.

Vulnerability Details

CVE-ID: CVE-2026-63975

Affected Software: Linux Kernel

Affected Versions: Linux Kernel 5.7 and various versions up to 5.10.259, 5.15.210, and 6.1.176

Vulnerability: The vulnerability resides in the l2cap_ecred_conn_rsp function. An unauthenticated adjacent attacker can send a specially crafted packet that triggers an invalid channel deletion, leading to memory corruption or a kernel panic.

Business Impact

Successful exploitation results in a denial of service, forcing a system reboot and disrupting critical services. With a CVSS score of 8.8, this vulnerability poses a high risk to the availability of systems using Bluetooth, particularly in environments where high uptime is required.

Remediation Plan

Immediate Action: Update the Linux kernel to version 5.10.259, 5.15.210, 6.1.176, 6.6.143, or newer.

Proactive Monitoring: Review dmesg and system logs for L2CAP related errors or unexpected kernel crashes following Bluetooth activity.

Compensating Controls: Restrict Bluetooth radio access to trusted environments or disable the Bluetooth subsystem if it is not essential for the host hardware.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof of concept for this vulnerability. The complexity of the L2CAP state machine generally makes reliable exploitation difficult, though not impossible.

Analyst Recommendation

The severity of this issue necessitates immediate patching. Organizations should coordinate with their Linux distribution maintainers to ensure that the kernel updates are applied to all affected endpoints.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 5.18.18 up to 5.19, 5.19.2 up to 5.20, and specific commit ranges
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A race condition in the Linux kernel Bluetooth subsystem allows for potential memory corruption or system instability during device shutdown and reset sequences.

Executive Summary:
A vulnerability in the Linux kernel Bluetooth hci_sync component may lead to system instability or denial of service due to improper workqueue handling during device shutdown.

Vulnerability Details

CVE-ID: CVE-2026-63974

Affected Software: Linux Kernel

Affected Versions: Linux Kernel versions 5.18.18 up to 5.19, 5.19.2 up to 5.20, and various development branches

Vulnerability: This is an improper synchronization vulnerability within the Bluetooth hci_sync module. An unauthenticated local or adjacent attacker can trigger a race condition during the device close or reset path, potentially leading to a kernel panic or unauthorized memory access.

Business Impact

A successful exploit could result in a denial of service (system crash) or potentially arbitrary code execution in the kernel context. Given the CVSS score of 8.8, this represents a significant risk to system availability and integrity, particularly for servers or embedded devices relying on Bluetooth connectivity.

Remediation Plan

Immediate Action: Update the Linux kernel to version 6.12.93, 6.18.35, 7.0.12, or the latest stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops, stack traces, or recurring Bluetooth service crashes that may indicate exploitation attempts.

Compensating Controls: If patching is not immediately feasible, disable the Bluetooth service if it is not required for system operations to eliminate the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof of concept for this vulnerability. The flaw exists due to complex race conditions within the kernel stack, which typically require specific timing to successfully trigger.

Analyst Recommendation

This vulnerability presents a high risk to kernel stability. Administrators should prioritize applying the provided kernel patches as soon as they are integrated into their respective distribution repositories to prevent potential system compromise.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 6.6.x before 6.6.143, 6.12.x before 6.12.93, 6.18.x before 6.18.35
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A security flaw in the Linux kernel memfd implementation fails to properly deny writable mappings when SEAL_EXEC is present, violating W^X memory protection requirements.

Executive Summary:
A high-severity memory protection bypass in the Linux kernel allows local users to circumvent W^X security policies, potentially leading to unauthorized code execution.

Vulnerability Details

CVE-ID: CVE-2026-63952

Affected Software: Linux Kernel

Affected Versions: 6.6.x before 6.6.143, 6.12.x before 6.12.93, 6.18.x before 6.18.35, 7.0.x before 7.0.12

Vulnerability: This is a memory sealing vulnerability in the memfd subsystem. The issue arises when SEAL_EXEC is applied, as the kernel fails to correctly enforce the implication of SEAL_WRITE, allowing authenticated local users to create writable memory mappings that should be restricted.

Business Impact

This vulnerability undermines the W^X (Write XOR Execute) security mechanism, which is critical for preventing arbitrary code execution. By bypassing these protections, an attacker could potentially inject and execute malicious code within a protected memory region, leading to full system compromise. The CVSS score of 8.4 reflects the high risk to system security.

Remediation Plan

Immediate Action: Update the Linux kernel to the patched versions (6.6.143, 6.12.93, 6.18.35, 7.0.12, or later).

Proactive Monitoring: Audit system calls related to memfd_create and seal operations to identify unusual memory mapping behavior.

Compensating Controls: Utilize SELinux or AppArmor profiles to restrict the ability of untrusted processes to perform memory-related system calls.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires a specific sequence of system calls to trigger the bypass.

Analyst Recommendation

Security teams should treat this as a high-priority update due to the impact on core memory security policies. Applying the kernel patch is the only definitive way to restore the integrity of the W^X protection mechanism.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux 2.6.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A buffer handling vulnerability in the Linux kernel Bluetooth HIDP implementation allows for memory corruption due to missing length checks in hidp_input_report.

Executive Summary:
A missing length check in the Linux kernel Bluetooth HIDP implementation could allow an unauthenticated attacker to cause a denial of service or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-63947

Affected Software: Linux Kernel

Affected Versions: Linux 2.6.12

Vulnerability: The function hidp_input_report fails to verify that the skb length contains sufficient data before reading keyboard and mouse payload information. This lack of validation allows an unauthenticated attacker on the adjacent network to trigger an out-of-bounds read or memory corruption.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe risk to system security. Successful exploitation could lead to full system compromise or persistent service disruption, making it a critical priority for security teams managing Linux environments.

Remediation Plan

Immediate Action: Update the Linux kernel to version 5.15.210, 6.1.176, 6.6.143, or 6.12.93 to incorporate the necessary bounds checking.

Proactive Monitoring: Use system monitoring tools to detect abnormal kernel behavior or crashes following Bluetooth activity.

Compensating Controls: Deploy network-level protections or restrict Bluetooth connectivity to environments where such communication is strictly governed and monitored.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Missing bounds checks in input parsing functions are classic entry points for memory corruption attacks.

Analyst Recommendation

Security administrators must ensure that all systems running the affected Linux kernel versions are updated as soon as possible. The inherent risks associated with kernel memory corruption make immediate patching the required course of action.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux 6.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Linux kernel Bluetooth ISO implementation allows for potential memory corruption due to improper lock management in iso_recv_frame.

Executive Summary:
A use-after-free vulnerability in the Linux kernel Bluetooth ISO implementation could allow an unauthenticated attacker to compromise system stability.

Vulnerability Details

CVE-ID: CVE-2026-63946

Affected Software: Linux Kernel

Affected Versions: Linux 6.0

Vulnerability: The function iso_recv_frame improperly releases a lock while still requiring a reference to an object (sk), resulting in a use-after-free scenario. This flaw is accessible to unauthenticated attackers positioned on the adjacent network.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting the potential for significant impact on system integrity and availability. Exploitation could allow an attacker to trigger kernel panics or potentially gain unauthorized control over affected systems by corrupting kernel memory.

Remediation Plan

Immediate Action: Update the Linux kernel to version 6.1.176, 6.6.143, 6.12.93, or 6.18.35 to remediate the vulnerability.

Proactive Monitoring: Review system logs for unusual Bluetooth-related crash reports or kernel memory errors that could indicate an exploitation attempt.

Compensating Controls: If patching is delayed, restrict Bluetooth access to authorized devices or disable the Bluetooth service entirely on high-risk systems.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's location in the networking stack makes it a high-value target for remote attackers.

Analyst Recommendation

Given the CVSS score and the nature of kernel-level vulnerabilities, organizations should treat this issue with urgency. Applying the vendor-provided security updates is the only definitive way to mitigate this risk.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux 6.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability exists in the Linux kernel Bluetooth subsystem due to improper lock handling within the hci_le_create_cis_sync function.

Executive Summary:
A use-after-free vulnerability in the Linux kernel Bluetooth subsystem could allow an unauthenticated attacker to cause system instability or potential code execution.

Vulnerability Details

CVE-ID: CVE-2026-63944

Affected Software: Linux Kernel

Affected Versions: Linux 6.4

Vulnerability: This is a memory management flaw where the kernel dereferences a pointer (conn->conn_timeout) after releasing necessary locks, leading to a use-after-free condition. The vulnerability is exploitable by an unauthenticated attacker via the adjacent network.

Business Impact

Successful exploitation of this use-after-free vulnerability can lead to system crashes (Denial of Service) or potential arbitrary code execution within the kernel context. Given the CVSS score of 8.8 (High), this represents a significant risk to system availability and integrity, particularly for devices utilizing Bluetooth connectivity.

Remediation Plan

Immediate Action: Update the Linux kernel to version 6.6.143, 6.12.93, 6.18.35, or 7.0.12, as these releases contain the necessary security fixes.

Proactive Monitoring: Monitor system logs for kernel oops or panic messages that may indicate memory corruption or unexpected Bluetooth subsystem behavior.

Compensating Controls: Disable Bluetooth services on critical infrastructure hosts where wireless connectivity is not required to eliminate the attack vector.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Use-after-free flaws in the kernel are inherently difficult to exploit but are highly dangerous when successful.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate attention for all Linux systems with active Bluetooth stacks. Administrators should prioritize the deployment of the provided kernel patches to prevent potential exploitation and maintain system stability.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux 6.11 and earlier, fixed in 7.0.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper capping vulnerability exists in the Linux kernel KVM arm64 implementation regarding the handling of ZCR_EL2 by guest hypervisors.

Executive Summary:
A vulnerability in the Linux kernel KVM arm64 subsystem could allow a guest hypervisor to bypass security controls, leading to potential host-level impact.

Vulnerability Details

CVE-ID: CVE-2026-63941

Affected Software: Linux Kernel

Affected Versions: Linux 6.11 and earlier versions prior to the 7.0.12 release.

Vulnerability: The kernel fails to correctly cap the ZCR_EL2 register provided by a guest hypervisor. A guest hypervisor can manipulate this register using either ZCR_EL2 or ZCR_EL1, bypassing intended restrictions and potentially affecting host system operations.

Business Impact

The ability to manipulate architectural registers from a guest hypervisor presents a significant security risk. With a CVSS score of 8.8, this flaw could allow an attacker to escape the guest environment or impact the host kernel, leading to unauthorized access and potential disruption of all hosted services.

Remediation Plan

Immediate Action: Update the Linux kernel to version 7.0.12 or apply the provided upstream stable patches immediately.

Proactive Monitoring: Monitor host systems for irregular architectural trap events or unexpected behavior within KVM arm64 environments.

Compensating Controls: Utilize hardware-level security features and ensure that only trusted hypervisors are permitted to run on the infrastructure.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of manipulating arm64 registers typically requires deep technical knowledge, but the impact is profound.

Analyst Recommendation

This vulnerability represents a critical risk for arm64-based cloud and virtualization platforms. Organizations must prioritize the deployment of the patched kernel to ensure the integrity of the isolation boundary between guest hypervisors and the host system.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux 6.11 and earlier, with specific fixes for 6.12.93, 6.18.35, and 7.0.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Time-of-Check Time-of-Use (TOCTOU) vulnerability in the Linux kernel KVM SEV implementation arises from improper handling of the Page State Change buffer.

Executive Summary:
A TOCTOU vulnerability in the Linux kernel KVM SEV subsystem could allow a local attacker to manipulate guest memory states, leading to potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-63937

Affected Software: Linux Kernel

Affected Versions: Linux 6.11 and various earlier versions requiring specific branch updates.

Vulnerability: The issue exists within the guest-accessible Page State Change buffer. By failing to use READ_ONCE, the kernel is susceptible to TOCTOU bugs, which an authenticated local attacker can leverage to influence the hypervisor state.

Business Impact

This vulnerability poses a high risk to virtualized environments, as it allows for the manipulation of page states within KVM. With a CVSS score of 8.8, successful exploitation can lead to a breakout from a guest environment, resulting in unauthorized access to host memory or the compromise of other guest virtual machines.

Remediation Plan

Immediate Action: Apply the vendor-supplied security patches, specifically updating to kernel versions 6.12.93, 6.18.35, or 7.0.12 as appropriate for your distribution.

Proactive Monitoring: Review virtualization host logs for unusual KVM activity or errors related to memory management and page state changes.

Compensating Controls: Ensure that guest virtual machines are isolated using robust security policies and that the host kernel is hardened against local privilege escalation.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on TOCTOU timing makes this exploit complex, but the potential for hypervisor-level impact remains severe.

Analyst Recommendation

Security teams managing virtualized infrastructure must treat this vulnerability with high urgency. Patching the host kernel is the only definitive way to eliminate the window of opportunity for a TOCTOU-based attack on the Page State Change buffer.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 5.10.x before 5.10.259, 5.15.x before 5.15.210, 6.1.x before 6.1.176
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A memory management flaw exists in the Linux kernel bpf_msg_push_data function, where improper handling of scatterlist fragment offsets during data insertion can lead to memory corruption.

Executive Summary:
A high-severity memory corruption vulnerability in the Linux kernel eBPF subsystem allows local attackers to potentially gain elevated privileges or cause system crashes.

Vulnerability Details

CVE-ID: CVE-2026-63926

Affected Software: Linux Kernel

Affected Versions: 5.10.x before 5.10.259, 5.15.x before 5.15.210, 6.1.x before 6.1.176, 6.6.x before 6.6.143

Vulnerability: This is a memory management issue within the sockmap implementation of the eBPF subsystem. The vulnerability occurs due to improper tail fragment offset calculation during data insertion, which affects unauthenticated local users.

Business Impact

Successful exploitation of this kernel-level vulnerability could allow a local attacker to corrupt memory, leading to unauthorized privilege escalation or a complete system denial of service. With a CVSS score of 8.4, this vulnerability represents a significant risk to system integrity and availability, particularly in multi-tenant environments or systems where local user access is permitted.

Remediation Plan

Immediate Action: Update the Linux kernel to version 5.10.259, 5.15.210, 6.1.176, 6.6.143, or later as appropriate for your distribution.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected process crashes that may indicate exploitation attempts.

Compensating Controls: Restrict access to the eBPF subsystem by adjusting sysctl settings, specifically setting kernel.unprivileged_bpf_disabled to 1.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently complex to exploit, requiring specific local access conditions.

Analyst Recommendation

Given the potential for privilege escalation, administrators should prioritize patching the kernel across all affected production environments. If an immediate reboot is not feasible, ensure that unprivileged eBPF access is strictly disabled via system configuration to reduce the attack surface.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 5.7 and later versions prior to stable releases 5.10.259, 5.15.210, and 6.1.176
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A replay protection failure in the Linux kernel macsec implementation at XPN lower-PN wrap allows for potential packet manipulation.

Executive Summary:
A high-severity flaw in the Linux kernel MACsec implementation could allow an adjacent attacker to bypass replay protection mechanisms.

Vulnerability Details

CVE-ID: CVE-2026-63925

Affected Software: Linux Kernel (macsec)

Affected Versions: 5.7 and later versions prior to stable releases 5.10.259, 5.15.210, and 6.1.176

Vulnerability: The vulnerability occurs in macsec_post_decrypt when the packet number reaches U32_MAX, causing an overflow that prevents the replay protection branch from executing. This allows an attacker with adjacent access to potentially replay or manipulate encrypted traffic.

Business Impact

Exploitation of this flaw undermines the security guarantees of MACsec, which is intended to protect traffic at the data link layer. This could lead to the integrity of network communications being compromised, potentially allowing for unauthorized data injection or replay attacks against sensitive internal services.

Remediation Plan

Immediate Action: Update the kernel to version 5.10.259, 5.15.210, 6.1.176, or later, as recommended by your Linux distribution provider.

Proactive Monitoring: Review network traffic patterns for anomalies that might indicate replay attempts on MACsec-secured links.

Compensating Controls: Ensure that additional layers of encryption, such as TLS or IPsec, are employed to protect data even if the underlying link-layer security is bypassed.

Exploitation Status

Public Exploit Available: unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The issue is a specific edge-case error in cryptographic sequence handling, which is inherently complex to exploit in a real-world environment.

Analyst Recommendation

While the complexity of exploiting this flaw is relatively high, the impact on network-level security is severe. Administrators are strongly advised to update their systems to the latest stable kernel versions to ensure that MACsec replay protection functions correctly under all packet number conditions.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux 6.13 and earlier versions leading to 7.0.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A validation vulnerability exists in the Linux kernel octeontx2-af driver within the rvu_mbox_handler_rep_event_notify function, potentially allowing for improper input handling.

Executive Summary:
An improper input validation flaw in the Linux kernel octeontx2-af driver could allow a local authenticated attacker to compromise system integrity and availability.

Vulnerability Details

CVE-ID: CVE-2026-63923

Affected Software: Linux Kernel

Affected Versions: Linux 6.13 and earlier branches prior to the 7.0.12 release.

Vulnerability: This vulnerability involves a failure to properly validate the body pcifunc in the rvu_mbox_handler_rep_event_notify function. An attacker with local access and low privileges can trigger this flaw to cause a scope-crossing impact.

Business Impact

Successful exploitation of this kernel-level vulnerability could lead to a complete system compromise. Given the CVSS score of 8.8, this represents a significant risk where an attacker may gain elevated control, potentially resulting in unauthorized data access, system instability, or full service disruption.

Remediation Plan

Immediate Action: Update the Linux kernel to version 7.0.12 or later, or apply the upstream patches provided in the kernel stable repository.

Proactive Monitoring: Monitor system logs for kernel panic events or unexpected driver-related crashes that may indicate exploitation attempts.

Compensating Controls: Restrict local access to the system to only authorized personnel and ensure that users operate with the minimum necessary privileges to reduce the attack surface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Kernel vulnerabilities of this nature are inherently dangerous due to their potential for arbitrary code execution within the kernel context.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate attention. Administrators should prioritize patching the kernel to the recommended version to mitigate the risk of local privilege escalation and system compromise.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 3.15 up to 5.10.259, 5.15.210, 6.1.176
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Linux kernel IP6 VTI implementation relates to improper tunnel handling, mirroring logic issues found in related networking components.

Executive Summary:
An improper configuration in the Linux kernel IP6 VTI subsystem poses a high risk of local privilege escalation and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-63921

Affected Software: Linux Kernel

Affected Versions: 3.15 through 5.10.258, 5.15.0 through 5.15.209, 6.1.0 through 6.1.175

Vulnerability: Similar to other IP6 VTI flaws, this vulnerability involves incorrect usage of tunnel encapsulation functions, which can be leveraged by an authenticated local user to bypass security boundaries.

Business Impact

With a CVSS score of 8.8, this flaw presents a severe threat to local system security. Exploitation allows an attacker to escalate privileges from a low-privileged user to a higher-privileged state, potentially compromising the confidentiality and integrity of all data on the host.

Remediation Plan

Immediate Action: Update the Linux kernel to version 5.10.259, 5.15.210, 6.1.176, or later, as provided by your distribution vendor.

Proactive Monitoring: Review system logs for signs of unauthorized privilege escalation attempts or unusual kernel-related errors.

Compensating Controls: Limit access to system-level commands and ensure that kernel-level security modules like SELinux or AppArmor are configured to enforce strict access policies.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. This is a local-vector vulnerability that requires existing low-level user access.

Analyst Recommendation

System administrators should prioritize the deployment of the provided kernel updates. Addressing this vulnerability is essential for maintaining the security posture of systems where local user access is permitted.