---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 5.6 up to 5.10.259, 5.15.210, 6.1.176
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A reference counting vulnerability in the Linux kernel XFRM subsystem allows for potential memory corruption during deferred transport reinjection.

Executive Summary:
Failure to properly manage network namespace references in the Linux kernel XFRM subsystem creates a critical risk of system instability and potential code execution.

Vulnerability Details

CVE-ID: CVE-2026-63919

Affected Software: Linux Kernel

Affected Versions: 5.6 through 5.10.258, 5.15.0 through 5.15.209, 6.1.0 through 6.1.175

Vulnerability: The flaw exists in the XFRM (IPsec) input path, where the kernel fails to hold a network namespace reference during deferred transport reinjection, allowing an authenticated attacker to trigger use-after-free conditions.

Business Impact

This vulnerability carries a CVSS score of 8.8, reflecting its potential for remote exploitation to cause a denial of service or arbitrary code execution. Such a compromise could lead to complete system takeover, unauthorized access to sensitive network traffic, and significant operational downtime.

Remediation Plan

Immediate Action: Apply the latest kernel security patches (5.10.259, 5.15.210, 6.1.176, or newer) provided by your distribution maintainer.

Proactive Monitoring: Monitor network traffic and system stability for crashes or anomalous behavior related to IPsec processing.

Compensating Controls: Deploy network-level protections and ensure that IPsec configurations are hardened to limit exposure to potentially malicious traffic sources.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of the XFRM subsystem makes manual exploit development difficult but highly impactful.

Analyst Recommendation

Given the potential for remote exploitation, this vulnerability should be treated with high priority. Organizations must ensure that all production kernels are updated to the fixed versions to prevent potential system compromise.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 3.15 up to 5.10.259, 5.15.210, 6.1.176
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Linux kernel IP6 VTI implementation allows for potential privilege escalation due to improper handling of tunnel encapsulation.

Executive Summary:
An improper configuration in the Linux kernel IP6 VTI subsystem poses a high risk of local privilege escalation and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-63917

Affected Software: Linux Kernel

Affected Versions: 3.15 through 5.10.258, 5.15.0 through 5.15.209, 6.1.0 through 6.1.175

Vulnerability: This vulnerability resides in the IP6 VTI (Virtual Tunnel Interface) component, where improper use of ip6_tnl functions can be exploited by an authenticated local user to achieve scope-changing impacts.

Business Impact

Successful exploitation allows a local attacker to escalate privileges, potentially gaining full control over the host system. Given the CVSS score of 8.8, this represents a significant risk to data integrity and system availability, particularly in multi-tenant or shared computing environments.

Remediation Plan

Immediate Action: Update the Linux kernel to version 5.10.259, 5.15.210, 6.1.176, or later, as provided by your distribution vendor.

Proactive Monitoring: Audit system logs for unexpected kernel module loading or abnormal process behavior that may indicate an attempt to exploit kernel-level interfaces.

Compensating Controls: Restrict local shell access to untrusted users and ensure that kernel hardening features, such as lockdown mode, are enabled to limit the impact of potential exploits.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires an attacker to have local access, which serves as a primary barrier to entry.

Analyst Recommendation

The severity of this vulnerability necessitates immediate patching of kernel environments. Administrators should prioritize updating systems that allow local user access to mitigate the risk of privilege escalation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux 3.18 and above
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An out-of-bounds write vulnerability exists in the Linux kernel Wacom HID driver due to incorrect assumptions about feature report structures.

Executive Summary:
An out-of-bounds write vulnerability in the Linux kernel Wacom HID driver could allow an adjacent attacker to trigger memory corruption and potentially achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-63916

Affected Software: Linux Kernel

Affected Versions: Linux 3.18 and later (Fixed in 5.10.259, 5.15.210, 6.1.176, 6.6.143)

Vulnerability: The function wacom_hid_set_device_mode incorrectly assumes the HID_DG_INPUTMODE usage is always in the first field of the feature report. This lack of validation allows an adjacent attacker to force an out-of-bounds write.

Business Impact

The CVSS score of 8.8 underscores the critical nature of this memory corruption flaw. Successful exploitation can lead to system-wide compromise, as memory corruption in the kernel often facilitates privilege escalation or arbitrary code execution.

Remediation Plan

Immediate Action: Update the Linux kernel to 5.10.259, 5.15.210, 6.1.176, 6.6.143, or newer stable versions.

Proactive Monitoring: Review system logs for hardware initialization errors or crashes associated with HID input devices.

Compensating Controls: Restrict physical access to USB ports and prevent the connection of unauthorized HID devices in high-security environments.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires an attacker to be in proximity to the device to interact with the HID interface.

Analyst Recommendation

This vulnerability represents a significant risk to systems using Wacom input devices. Administrators should ensure that kernel patches are applied promptly to mitigate the risk of memory corruption and potential system compromise.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux 3.5 and above
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An out-of-bounds read vulnerability exists in the Linux kernel NFC HCI subsystem due to insufficient validation of packet headers during parsing.

Executive Summary:
An out-of-bounds read vulnerability in the Linux kernel NFC HCI subsystem could be exploited by an adjacent attacker to cause system instability or information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-63915

Affected Software: Linux Kernel

Affected Versions: Linux 3.5 and later (Fixed in 5.10.259, 5.15.210, 6.1.176, 6.6.143)

Vulnerability: The vulnerability exists in nfc_hci_recv_from_llc and nci_hci_data_received_cb. It is triggered by reading from packet headers without confirming the buffer contains sufficient data, allowing an unauthenticated adjacent attacker to cause an out-of-bounds read.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a high risk to availability and confidentiality. An attacker capable of sending malicious NFC packets could potentially crash the system or leak sensitive kernel memory contents.

Remediation Plan

Immediate Action: Update the Linux kernel to 5.10.259, 5.15.210, 6.1.176, 6.6.143, or newer stable versions.

Proactive Monitoring: Monitor dmesg and system logs for unexpected errors related to the NFC subsystem or kernel memory access violations.

Compensating Controls: Disable NFC interfaces at the kernel level if they are not required for system functionality to eliminate the attack surface.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for adjacent network access limits the potential attack vectors.

Analyst Recommendation

Organizations utilizing NFC hardware on Linux systems must treat this as a high-priority update. Immediate patching is recommended to prevent unauthorized information disclosure or service disruption through this memory corruption flaw.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux versions prior to 5.10.259, 5.15.210, 6.1.176, and 6.6.143
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A flaw in the Linux kernel netfilter conntrack TCP state machine allows unauthenticated attackers to force connections into a closed state using invalid sequence number RST packets.

Executive Summary:
A vulnerability in the Linux kernel netfilter component allows remote, unauthenticated attackers to disrupt network availability by forcing TCP connections into a closed state.

Vulnerability Details

CVE-ID: CVE-2026-63913

Affected Software: Linux Kernel

Affected Versions: Linux versions prior to 5.10.259, 5.15.210, 6.1.176, and 6.6.143

Vulnerability: This is a denial of service vulnerability within the netfilter conntrack mechanism. The flaw permits an unauthenticated attacker to manipulate the state machine by injecting RST packets with invalid sequence numbers, causing premature connection termination.

Business Impact

Successful exploitation results in the disruption of legitimate network traffic, leading to service downtime for affected applications and infrastructure. Given the CVSS score of 8.2, this vulnerability poses a significant risk to operational continuity, especially for high-availability systems that rely on stable TCP connections.

Remediation Plan

Immediate Action: Update the Linux kernel to version 5.10.259, 5.15.210, 6.1.176, or 6.6.143, depending on the current branch in use.

Proactive Monitoring: Monitor network traffic logs for an unusual frequency of RST packets or sudden, unexplained TCP connection drops.

Compensating Controls: Deploy network-level firewalls and intrusion detection systems configured to drop malformed TCP packets or packets with invalid sequence numbers.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any remote user capable of sending crafted TCP packets to the target system.

Analyst Recommendation

The severity of this issue is high due to the potential for widespread service disruption. Administrators should prioritize patching the Linux kernel across all production environments to mitigate the risk of remote connection termination attacks.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 6.6.140-6.6.142, 6.12.84-6.12.92, 6.18.25-6.18.34, 7.0.2-7.0.11
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An out-of-bounds read regression in the Linux kernel ksmbd module's access control entry processing can be triggered by a remote attacker.

Executive Summary:
A high-severity out-of-bounds read vulnerability in the Linux kernel ksmbd module could result in unauthorized information disclosure or system instability.

Vulnerability Details

CVE-ID: CVE-2026-63909

Affected Software: Linux Kernel (ksmbd)

Affected Versions: 6.6.140-6.6.142, 6.12.84-6.12.92, 6.18.25-6.18.34, 7.0.2-7.0.11

Vulnerability: The vulnerability stems from a transposed bounds check in the smb_check_perm_dacl function within the ksmbd module. An authenticated attacker can trigger this out-of-bounds read during ACE-walk loops.

Business Impact

This vulnerability poses a risk to data confidentiality and service availability. Because the ksmbd module handles SMB traffic, a successful exploit could allow an attacker to read sensitive memory contents or crash the kernel, leading to significant disruption in file-sharing environments.

Remediation Plan

Immediate Action: Apply the latest security updates provided by your Linux distribution to move to a patched kernel version (6.6.143, 6.12.93, 6.18.35, or 7.0.12).

Proactive Monitoring: Monitor SMB traffic and system logs for unexpected service restarts or segmentation faults related to the ksmbd kernel module.

Compensating Controls: If patching is delayed, consider disabling the ksmbd kernel module if it is not required for business operations.

Exploitation Status

Public Exploit Available: unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw arises from a logical error in a security check, which is a common regression pattern in kernel development.

Analyst Recommendation

Organizations utilizing the ksmbd kernel module for file services must treat this as a high-priority update. Promptly applying the vendor-supplied kernel patches is essential to prevent potential exploitation by authenticated users within the network.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 6.2 and various versions up to 6.1.175
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability exists in the Linux kernel omap2430 USB driver due to improper reference counting of device tree nodes during probe initialization.

Executive Summary:
A use-after-free flaw in the Linux kernel USB driver could allow an attacker to achieve system instability or arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-63906

Affected Software: Linux Kernel

Affected Versions: 6.2 and various versions up to 6.1.175

Vulnerability: The vulnerability resides in the omap2430_probe function, where an incorrect call to of_node_put leads to a use-after-free condition. This flaw can be triggered by an unauthenticated attacker, potentially allowing for memory corruption or system crashes.

Business Impact

The ability to trigger a use-after-free condition in the kernel poses a high risk to overall system integrity. Given the CVSS score of 8.4, successful exploitation could lead to full system compromise or persistent denial of service, impacting the reliability of hardware peripherals and connected services.

Remediation Plan

Immediate Action: Update the Linux kernel to version 6.1.176, 6.6.143, 6.12.93, or 6.18.35.

Proactive Monitoring: Review kernel logs for memory-related anomalies or driver-specific faults that could indicate an exploitation attempt.

Compensating Controls: If patching is delayed, disable the affected USB driver module if it is not required for system operation to eliminate the attack vector.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Use-after-free vulnerabilities in the kernel are notoriously complex to weaponize but highly dangerous when successful.

Analyst Recommendation

This is a high-severity kernel vulnerability that requires immediate attention. System administrators should verify current kernel builds and deploy the provided fixes to mitigate the risk of memory corruption and potential code execution.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 4.15 and later versions prior to stable releases 5.10.259, 5.15.210, and 6.1.176
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A integer wrap vulnerability in the Linux kernel Thunderbolt property subsystem allows for potential memory corruption.

Executive Summary:
A high-severity integer wrap vulnerability in the Linux kernel Thunderbolt subsystem could lead to system instability or unauthorized memory access.

Vulnerability Details

CVE-ID: CVE-2026-63893

Affected Software: Linux Kernel

Affected Versions: 4.15 and later versions prior to stable releases 5.10.259, 5.15.210, and 6.1.176

Vulnerability: The vulnerability exists in the tb_property_entry_valid function, where an integer wrap occurs during the sum of entry->value and entry->length. This flaw is reachable by an adjacent attacker, as indicated by the CVSS vector AV:A, requiring no authentication.

Business Impact

Successful exploitation of this vulnerability could result in a denial of service or potential information disclosure, impacting the integrity and availability of the affected system. With a CVSS score of 8.1, the risk is significant for environments utilizing Thunderbolt connectivity where physical or adjacent access is possible.

Remediation Plan

Immediate Action: Update the Linux kernel to version 5.10.259, 5.15.210, 6.1.176, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel crashes or unusual errors related to Thunderbolt device initialization.

Compensating Controls: If patching is not immediately feasible, restrict physical access to Thunderbolt ports on sensitive systems to mitigate the adjacent attack vector.

Exploitation Status

Public Exploit Available: unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is primarily an implementation error in input validation, which is common in complex driver subsystems.

Analyst Recommendation

Given the potential for kernel-level impact, organizations should prioritize patching affected systems in their next maintenance cycle. Applying the verified upstream fixes is the only definitive way to resolve this integer wrap vulnerability and prevent potential exploitation via adjacent network or physical interfaces.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 5.11 (refer to enrichment for specific commit ranges)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An integer overflow in the Linux kernel SCSI transport layer allows an adjacent attacker to trigger a system hang via malicious Fibre Channel frames.

Executive Summary:
A vulnerability in the Linux kernel SCSI transport layer permits an adjacent attacker to cause a denial of service by sending specifically crafted Fibre Channel frames.

Vulnerability Details

CVE-ID: CVE-2026-63889

Affected Software: Linux Kernel

Affected Versions: See enrichment data for specific commit ranges and versions like 5.11.

Vulnerability: The issue resides in the scsi_transport_fc module, where the FPIN (Fabric Performance Impact Notification) pname walker counter uses insufficient bit depth. An adjacent attacker can deliver a malicious FPIN ELS frame, causing the counter to overflow and trigger a non-return loop in the kernel.

Business Impact

Successful exploitation leads to a system hang or denial of service, impacting the availability of storage services reliant on Fibre Channel connectivity. Given the CVSS score of 8.1, this represents a significant risk to high-availability storage environments and enterprise-grade server infrastructure.

Remediation Plan

Immediate Action: Apply the latest stable kernel updates, specifically ensuring versions 5.15.210, 6.1.176, or 6.6.143 are deployed.

Proactive Monitoring: Monitor Fibre Channel fabric logs for malformed or unexpected ELS frames and observe system responsiveness during high storage traffic periods.

Compensating Controls: Isolate Fibre Channel networks and ensure only trusted devices can interact with the initiator, reducing the likelihood of malicious frame injection.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is triggered by specifically crafted network packets within the storage fabric.

Analyst Recommendation

Organizations operating Fibre Channel storage arrays must prioritize applying the provided kernel patches. This update is critical to preventing potential denial of service attacks that could disrupt vital storage operations and enterprise data availability.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 6.18.32 up to 6.18.35, 7.0.9 up to 7.0.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A race condition in the Linux kernel DRM GEM subsystem allows for potential handle manipulation issues due to improper locking during handle changes.

Executive Summary:
A race condition vulnerability in the Linux kernel DRM subsystem could allow a local authenticated attacker to achieve unauthorized system impact.

Vulnerability Details

CVE-ID: CVE-2026-63885

Affected Software: Linux Kernel

Affected Versions: 6.18.32 up to 6.18.35, 7.0.9 up to 7.0.12

Vulnerability: This is a race condition within the drm_gem_change_handle_ioctl function. It occurs because the old handle remains active in the IDR during the window between unlocking and re-locking the table_lock, requiring low privileges to exploit.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its potential for complete system compromise. Successful exploitation could lead to unauthorized data access, integrity loss, or a total system crash, posing a significant risk to the stability and security of the affected infrastructure.

Remediation Plan

Immediate Action: Update the Linux kernel to version 6.18.35, 7.0.12, or later stable releases where the fix is implemented.

Proactive Monitoring: Monitor system logs for unexpected kernel oops or crashes that may indicate race condition triggers during graphics driver operations.

Compensating Controls: Restrict access to local system resources and hardware acceleration features to authenticated users only.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently difficult to exploit due to the precise timing requirements associated with race conditions.

Analyst Recommendation

Given the high severity score, administrators should prioritize patching the Linux kernel during the next scheduled maintenance window. Ensuring the kernel is updated to the provided fixed versions is the only definitive method to eliminate this race condition risk.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift GitOps
AFFECTED_VERSIONS: Red Hat OpenShift GitOps
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A flaw in ArgoCD Image Updater within Red Hat OpenShift GitOps allows attackers with limited permissions to bypass namespace boundaries and trigger unauthorized image updates.

Executive Summary:
A critical privilege escalation vulnerability in Red Hat OpenShift GitOps allows attackers to bypass namespace isolation, potentially compromising the integrity of applications across a multi-tenant environment.

Vulnerability Details

CVE-ID: CVE-2026-6388

Affected Software: Red Hat OpenShift GitOps (ArgoCD Image Updater)

Affected Versions: Red Hat OpenShift GitOps

Vulnerability: The vulnerability (CWE-1220) stems from insufficient granularity in access control. An authenticated attacker with permissions to manage ImageUpdater resources can manipulate configurations to perform unauthorized actions on applications owned by other tenants, leading to cross-namespace privilege escalation.

Business Impact

With a CVSS score of 9.1, this vulnerability presents a significant risk to the integrity of containerized environments. In a multi-tenant setup, this flaw allows for the unauthorized deployment of images, which could be leveraged to inject malicious code into production applications, resulting in supply chain compromise or service disruption.

Remediation Plan

Immediate Action: Apply the relevant security updates provided by Red Hat as detailed in the official security advisory (BZ#2458766).

Proactive Monitoring: Review audit logs for ArgoCD and OpenShift to detect abnormal ImageUpdater resource modifications or unauthorized cross-namespace requests.

Compensating Controls: Limit the ability of users to create or modify ImageUpdater resources to only highly trusted administrators until the patch can be deployed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of the attack requires specific environmental configuration, but the impact of a successful breach is high.

Analyst Recommendation

Organizations utilizing Red Hat OpenShift GitOps should treat this vulnerability with high urgency. Administrators must review their current RBAC policies to restrict access to ImageUpdater resources and verify that the latest patches have been applied to mitigate the risk of cross-tenant exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 5.11 (refer to enrichment data for specific commit ranges)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A TOCTOU race condition in the Linux kernel MPTCP output path can lead to integrity issues or denial of service when computing receive windows.

Executive Summary:
A time-of-check to time-of-use race condition in the Linux kernel MPTCP implementation poses a risk of system instability or unauthorized integrity impacts.

Vulnerability Details

CVE-ID: CVE-2026-63867

Affected Software: Linux Kernel

Affected Versions: Versions prior to the stable releases 5.15.210, 6.1.176, 6.6.143, and 6.12.94.

Vulnerability: The MPTCP output path performs lockless access to sequence numbers, resulting in a TOCTOU (Time-of-Check to Time-of-Use) race condition that can affect the data acknowledgment process.

Business Impact

This vulnerability can lead to service degradation or denial of service, impacting system availability for critical network-heavy applications. Given the CVSS score of 8.2, the potential for network-level disruption necessitates prompt kernel updates to ensure system reliability and data integrity.

Remediation Plan

Immediate Action: Update the Linux kernel to version 5.15.210, 6.1.176, 6.6.143, 6.12.94, or later depending on your active distribution branch.

Proactive Monitoring: Monitor system logs for kernel panics or MPTCP-related error messages that may indicate instability caused by the race condition.

Compensating Controls: Limit exposure to untrusted network traffic and ensure that kernel hardening features are enabled to mitigate potential exploitation attempts.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The race condition is complex and likely requires specific network conditions to trigger effectively.

Analyst Recommendation

Linux kernel maintainers have addressed this through stable patches. Organizations should include these kernel updates in their standard patch management cycle to maintain system stability and prevent potential network-based exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux 6.15 and prior versions incorporating commit dd82a9e02c054052b5899872c1f32805428f6131
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A memory management flaw exists in the Linux kernel mt7996 Wi-Fi driver where failure to clear the WCID pointer during station link deinitialization can lead to memory corruption or instability.

Executive Summary:
A high-severity memory management vulnerability in the Linux kernel mt7996 Wi-Fi driver may allow a local attacker to cause a system crash or potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-63866

Affected Software: Linux Kernel

Affected Versions: Linux 6.15 and prior versions incorporating commit dd82a9e02c054052b5899872c1f32805428f6131

Vulnerability: This is a memory management vulnerability involving a failure to clear the Wireless Client Identifier (WCID) pointer during the mt7996_mac_sta_deinit_link routine. It requires an attacker to have adjacent network access to trigger the flaw, as indicated by the CVSS vector AV:A.

Business Impact

Successful exploitation could result in a kernel panic, leading to denial of service for affected wireless infrastructure. Given the CVSS score of 8.8, the potential for memory corruption introduces a risk of unauthorized system state manipulation, which could disrupt critical business operations reliant on wireless connectivity.

Remediation Plan

Immediate Action: Update the Linux kernel to version 6.18.33, 7.0.10, or 7.1 and later, where this issue has been resolved.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected service restarts related to the mt76 or mt7996 wireless drivers.

Compensating Controls: If patching is not immediately feasible, restrict access to the affected wireless network segments and implement robust physical or logical access controls to limit the exposure of the wireless interface.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is limited by the requirement for adjacent network access.

Analyst Recommendation

This vulnerability represents a significant risk to the stability and security of systems utilizing the mt7996 wireless chipset. Administrators should prioritize the deployment of the provided kernel patches to eliminate the potential for memory-based exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux 5.11 and later (see fixed packages for specific ranges)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Linux kernel improperly allows certain LSM sleepable hooks to be used from contexts that do not support sleep, leading to potential kernel instability or security bypasses.

Executive Summary:
Improper use of LSM sleepable hooks in the Linux kernel poses a high risk of system instability and potential security policy bypass.

Vulnerability Details

CVE-ID: CVE-2026-63865

Affected Software: Linux Kernel

Affected Versions: Versions prior to 5.15.209, 6.1.175, 6.6.141, and 6.12.91.

Vulnerability: This issue stems from the incorrect use of bpf_lsm_task_to_inode and bpf_lsm_inet_conn_established in sleepable LSM programs. These hooks are called from restricted contexts, such as rcu_read_lock or softirq context, where sleeping is forbidden, leading to invalid kernel operations.

Business Impact

Exploitation of this vulnerability allows a local attacker with low privileges to trigger kernel-level errors, potentially leading to a system crash or bypassing security policies enforced by LSMs. A CVSS score of 8.8 reflects the high danger posed by flaws that interfere with kernel security enforcement and system stability.

Remediation Plan

Immediate Action: Update the kernel to the patched versions (5.15.209, 6.1.175, 6.6.141, 6.12.91) or the latest version supplied by your distribution.

Proactive Monitoring: Watch for kernel panic events or unexpected system reboots that coincide with BPF program execution or LSM policy updates.

Compensating Controls: Audit and restrict the loading of eBPF programs, particularly those utilizing LSM hooks, until the kernel can be updated to a secure version.

Exploitation Status

Public Exploit Available: exploit_available (unknown)

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of triggering this via BPF makes it a targeted attack vector.

Analyst Recommendation

This vulnerability highlights the risks associated with eBPF and LSM integration in the kernel. System administrators should prioritize updating to the specified versions to ensure that security hooks operate within their intended constraints and to maintain overall platform security.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux kernels e40f5a6bf88a781d5f81bc6b8aab9ac31d8c98dd up to 6.19
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing error check in the Linux kernel BPF subsystem allows for potential memory corruption or instability during tail call processing.

Executive Summary:
A vulnerability in the Linux kernel BPF subsystem could allow an attacker to trigger memory corruption and system instability.

Vulnerability Details

CVE-ID: CVE-2026-63864

Affected Software: Linux Kernel

Affected Versions: Linux kernels e40f5a6bf88a781d5f81bc6b8aab9ac31d8c98dd up to 6.19

Vulnerability: This issue stems from a failure to propagate the return value of the visit_tailcall_insn function within the BPF subsystem, which can lead to incorrect stack liveness tracking. This is an unauthenticated local vulnerability.

Business Impact

Successful exploitation of this flaw can result in system crashes or potential escalation of privileges, leading to unauthorized access to sensitive data or complete system compromise. Given the CVSS score of 8.4, this vulnerability represents a high risk to infrastructure stability and data integrity.

Remediation Plan

Immediate Action: Update the Linux kernel to version 7.0.10, 7.1, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or unusual BPF program execution patterns that may indicate exploitation attempts.

Compensating Controls: Restrict access to BPF functionality to authorized users only, specifically limiting the capability to load BPF programs, which is often controlled via the CAP_BPF or CAP_SYS_ADMIN capabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is primarily an implementation error in memory management logic.

Analyst Recommendation

The severity of this kernel vulnerability necessitates prompt action. Administrators should prioritize patching their Linux environments to the specified fixed versions to prevent potential local exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux 7.0 prior to 7.0.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An unbalanced lock usage in the Linux kernel drm/gpusvm component, specifically within the drm_gpusvm_scan_mm function, can lead to denial of service or potential privilege escalation.

Executive Summary:
An unbalanced lock in the Linux kernel GPU SVM module creates a critical risk of denial of service or system compromise.

Vulnerability Details

CVE-ID: CVE-2026-63863

Affected Software: Linux Kernel

Affected Versions: Linux 7.0 versions prior to 7.0.10.

Vulnerability: This vulnerability involves an unbalanced lock and unlock sequence regarding the gpusvm notifier lock. The issue allows a local authenticated user (PR:L) to trigger a state where the kernel may hang or enter an inconsistent state, potentially leading to unauthorized memory access or system failure.

Business Impact

The ability for a local user to cause a kernel-level failure or memory inconsistency carries a high risk of service disruption and potential elevation of privilege. With a CVSS score of 8.8, this flaw necessitates urgent attention, particularly in multi-user or containerized environments where local access is granted to untrusted entities.

Remediation Plan

Immediate Action: Apply the latest kernel security updates provided by your Linux distribution, specifically ensuring the kernel is updated to at least version 7.0.10.

Proactive Monitoring: Review system audit logs for repeated segmentation faults or kernel warnings associated with GPU drivers or memory management operations.

Compensating Controls: Restrict local access to the system for untrusted users to prevent the initiation of malicious processes that could leverage this vulnerability.

Exploitation Status

Public Exploit Available: exploit_available (unknown)

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for local access and low privileges means the vulnerability is most dangerous in environments with shared local access.

Analyst Recommendation

Maintaining kernel integrity is essential for system security. Given the high severity of this lock-related flaw, organizations should move to implement the relevant patches as soon as they are made available by their upstream kernel maintainers or distribution vendors.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux Kernel versions prior to 5.10.258, 5.15.209, 6.1.175, and 6.6.141
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Linux kernel RDMA core component involves improper handling of NLA_STRING attributes, potentially leading to memory issues when checking for null terminators.

Executive Summary:
A high-severity vulnerability in the Linux kernel RDMA subsystem could allow for local privilege escalation or system instability due to improper string handling.

Vulnerability Details

CVE-ID: CVE-2026-63860

Affected Software: Linux Kernel

Affected Versions: Linux Kernel versions prior to 5.10.258, 5.15.209, 6.1.175, and 6.6.141

Vulnerability: This is a memory handling flaw where the RDMA core incorrectly evaluates attributes as C-strings without verifying the presence of a null terminator. The vulnerability is exploitable by local, unauthenticated users.

Business Impact

The vulnerability carries a CVSS score of 8.4, reflecting the potential for complete system compromise. Successful exploitation could lead to unauthorized access, modification of sensitive data, or denial of service, significantly impacting system integrity and operational availability.

Remediation Plan

Immediate Action: Update the Linux kernel to version 5.10.258, 5.15.209, 6.1.175, 6.6.141, or later versions where the fix has been backported.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or unusual RDMA subsystem activity that may indicate an exploitation attempt.

Compensating Controls: Restrict access to RDMA-enabled interfaces and ensure that local user privileges are strictly managed to minimize the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherent to the kernel's memory management logic during string processing.

Analyst Recommendation

Given the high CVSS score and the critical nature of the Linux kernel, immediate patching is required. Administrators should prioritize updating systems running vulnerable kernels to the specified fixed versions to prevent potential local exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 6.12.13 up to (excluding) 6.13, 6.13.2 up to (excluding) 6.14, and various development branches
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A race condition or improper handling in the Linux kernel mt76 wifi driver allows unauthorized memory reinitialization due to a missing wcid publish check.

Executive Summary:
A vulnerability in the Linux kernel mt76 wifi driver could lead to system instability or memory corruption, posing a high risk to affected wireless infrastructures.

Vulnerability Details

CVE-ID: CVE-2026-63832

Affected Software: Linux Kernel

Affected Versions: 6.12.13 up to (excluding) 6.13, 6.13.2 up to (excluding) 6.14, and specific development commits.

Vulnerability: This is an improper check vulnerability within the mt76 wifi driver, specifically in the mt76_sta_add function. The flaw allows an attacker to trigger unintended reinitialization of the wcid poll_list, and the attack vector is categorized as adjacent (AV:A).

Business Impact

Successful exploitation of this kernel-level vulnerability could result in a denial of service or potential privilege escalation. Given the CVSS score of 8.8, this represents a high-severity risk that could impact the availability and integrity of systems relying on affected wireless hardware.

Remediation Plan

Immediate Action: Update the Linux kernel to version 6.18.38, 7.1.3, or later versions where the fix has been backported.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected crashes related to the mt76 wifi driver modules.

Compensating Controls: Restrict access to wireless management interfaces to authorized personnel only to reduce the likelihood of remote adjacent exploitation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is an inherent logic error in the driver code that requires specific conditions to trigger.

Analyst Recommendation

Organizations utilizing Linux-based systems with mt76 wireless drivers should prioritize applying the provided kernel patches. Given the potential for system-wide impact, testing and deploying the stable kernel release is the most effective method to mitigate this high-severity risk.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux kernel versions prior to 5.10.260, 5.15.211, 6.1.177, and 6.6.144
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A memory safety flaw in the Linux mac802154 wireless subsystem fails to perform necessary data copying before in-place cryptographic operations, leading to potential memory corruption.

Executive Summary:
A memory safety flaw in the Linux mac802154 wireless subsystem could allow an adjacent attacker to trigger memory corruption or system crashes.

Vulnerability Details

CVE-ID: CVE-2026-63831

Affected Software: Linux Kernel

Affected Versions: Linux kernel versions prior to 5.10.260, 5.15.211, 6.1.177, and 6.6.144

Vulnerability: The vulnerability resides in the mac802154 llsec implementation. It performs in-place cryptographic transformations on network packets without using skb_cow_data(), which can lead to memory corruption when the underlying buffer is shared or read-only.

Business Impact

An attacker within radio range (adjacent network) could potentially exploit this to cause a denial of service or, in specific configurations, execute arbitrary code. Given the CVSS score of 8.8, this vulnerability is critical for systems using IEEE 802.15.4 wireless protocols, such as IoT gateways and industrial control sensors.

Remediation Plan

Immediate Action: Update the Linux kernel to version 5.10.260, 5.15.211, 6.1.177, 6.6.144, or later.

Proactive Monitoring: Monitor for kernel panics or unexplained memory errors in systems that utilize mac802154 drivers.

Compensating Controls: If patching is delayed, disable wireless interfaces utilizing the mac802154 protocol if they are not strictly required for business operations.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires proximity to the target, the nature of the flaw makes it a high-priority item for devices exposed to wireless network traffic.

Analyst Recommendation

This vulnerability represents a significant risk for wireless-enabled Linux hardware. Organizations should prioritize updating affected kernels to prevent memory corruption attacks and maintain the security of wireless communication channels.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux kernel versions prior to 6.12.95, 6.18.38, and 7.1.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A privilege check vulnerability exists in the Linux kernel ip_gre tunnel implementation, failing to properly enforce CAP_NET_ADMIN requirements during device changelink operations.

Executive Summary:
A missing privilege check in the Linux kernel IP GRE tunnel implementation could allow a local authenticated attacker to perform unauthorized network configuration changes.

Vulnerability Details

CVE-ID: CVE-2026-63829

Affected Software: Linux Kernel

Affected Versions: Linux kernel versions prior to 6.12.95, 6.18.38, and 7.1.3

Vulnerability: The vulnerability exists in the ip_gre module. It fails to require CAP_NET_ADMIN privileges in the device network namespace during a tunnel changelink operation, allowing an authenticated local user to modify network tunnel settings without the appropriate permissions.

Business Impact

An attacker could leverage this flaw to redirect network traffic or perform man-in-the-middle attacks within the network namespace. With a CVSS score of 8.8, this poses a substantial risk to network integrity and confidentiality, particularly in environments utilizing containerized networking or virtualized network tunnels.

Remediation Plan

Immediate Action: Apply the latest security patches provided by your Linux distribution to update the kernel to the versions listed above.

Proactive Monitoring: Review network interface configuration logs for unauthorized changes to GRE tunnel parameters or unexpected interface modifications.

Compensating Controls: Implement strict Network Namespace isolation and ensure that users do not have elevated privileges within restricted network namespaces.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for local access and specific namespace configuration limits the attack surface, but the potential for network traffic manipulation remains a serious concern.

Analyst Recommendation

Administrators should treat this vulnerability with high urgency, especially in systems hosting multiple users or containers. Updating the kernel to the specified version is the only effective way to ensure that privilege checks are correctly enforced for tunnel operations.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 3.6 up to (excluding) 6.1.177, 6.6.144, 6.12.95, and 6.18.38
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A security flaw in the Linux kernel AppArmor module fails to properly mediate the implicit connection associated with TCP Fast Open sendmsg operations.

Executive Summary:
A bypass vulnerability in the Linux kernel AppArmor subsystem may allow unauthorized network connections to circumvent established security policies.

Vulnerability Details

CVE-ID: CVE-2026-63828

Affected Software: Linux Kernel

Affected Versions: 3.6 up to (excluding) 6.1.177, 6.6.144, 6.12.95, and 6.18.38

Vulnerability: The vulnerability exists in the AppArmor mediation logic for TCP Fast Open. A local user with low privileges can perform a sendmsg operation that initiates a network connection without the intended AppArmor access controls being applied.

Business Impact

This flaw undermines the security enforcement provided by AppArmor, potentially allowing restricted processes to communicate with unauthorized network endpoints. With a CVSS score of 8.4, this represents a significant risk for environments that rely on mandatory access control to sandbox applications or services.

Remediation Plan

Immediate Action: Apply the latest kernel security updates to move to version 6.1.177, 6.6.144, 6.12.95, 6.18.38, or newer.

Proactive Monitoring: Review AppArmor audit logs for unexpected network activity originating from sandboxed applications.

Compensating Controls: Use network-level firewalls to restrict outbound traffic from sensitive processes, providing a secondary layer of defense if AppArmor is bypassed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The issue highlights a gap in how modern socket features like TCP Fast Open interact with existing security hooks.

Analyst Recommendation

The reliance on AppArmor for process isolation makes this an important update for security-hardened Linux distributions. Administrators should verify their current kernel version and apply the recommended patches to restore full mediation of network operations.