Linux Kernel: 25 Vulnerabilities Across Subsystems Addressed in Coordinated July 2026 Disclosure
A batch of 25 vulnerabilities affecting diverse subsystems of the Linux kernel was disclosed on July 25, 2026, with fixes released in version 6.9.3.
Key findings
- 25 Linux kernel vulnerabilities disclosed in a single batch on July 25, 2026.
- Fixes span multiple subsystems including networking, USB, Wi-Fi, and architecture-specific drivers.
- Issues range from resource management and error handling to potential NULL pointer dereferences.
- All vulnerabilities were addressed in a coordinated release, with fixes available in kernel version 6.9.3.
On July 25, 2026, a batch of 25 vulnerabilities was disclosed in the Linux kernel, all addressed in a single coordinated release. These issues span various subsystems, including LoongArch, batman-adv, hwmon, regulators, networking, graphics, USB, Wi-Fi, block devices, MIPS architecture, input devices, device properties, and memory management. The disclosures highlight the ongoing efforts to maintain the security and stability of the Linux kernel across a wide range of hardware and software components.
Several vulnerabilities relate to proper resource management and error handling. CVE-2026-64250 and CVE-2026-64248 address the reporting of dying CPUs to RCU in the LoongArch and MIPS architectures, respectively, preventing potential race conditions. CVE-2026-64218 in the batman-adv module fixes a report work leak during backbone gateway purges. The hwmon subsystem is affected by CVE-2026-64213, which adds lock protection to lm90_alert to prevent concurrent access issues. In the regulator subsystem, CVE-2026-64230 corrects an issue where irq_data.rdev was not being assigned in the tps65219 driver.
Networking and device-specific drivers also saw multiple fixes. CVE-2026-64210 addresses an unlocked write to ICOSQ during napi poll in the net/mlx5e driver, while CVE-2026-64215 ensures a NULL pointer dereference is avoided in the drm/msm/a6xx driver by checking kzalloc's return value. The usb gadget subsystem has two related fixes: CVE-2026-64237 ensures proper handling of extension units in the uvc driver, and CVE-2026-64242 fixes a double free in the net2280 driver's probe error path. Wi-Fi drivers are affected by CVE-2026-64212 (iwlwifi: mld: NULL check before dereference) and CVE-2026-64223 (mac80211: consume only present negotiated TTLM maps).
Memory management and architecture-specific issues are also present. CVE-2026-64230 in the regulator subsystem fixes an assignment issue. CVE-2026-64252 prevents the initial console buffer from landing in XKPHYS on MIPS DEC systems. CVE-2026-64237 validates firmware size in the elan_i2c driver. CVE-2026-64220 ensures fwnode->secondary is set to NULL in fwnode_init(). The block subsystem is addressed by CVE-2026-64232, which recomputes nr_integrity_segments in blk_insert_cloned_request.
Further fixes include CVE-2026-64225 and CVE-2026-64224, which address out-of-bounds array access and double frees in the octeontx2-af and octeontx2-pf drivers, respectively. CVE-2026-64245 fixes a possible UAF in fb_find_mode(). CVE-2026-64234 adds a check for dma_alloc_coherent() failure in the pch_uart driver. CVE-2026-64229 disables broadcast TLB flush when PCID is disabled on x86 systems, and CVE-2026-64235 relocates %rip-relative percpu refs in dynamic trampolines. CVE-2026-64253 ensures PF_BLOCK_TS is cleared in copy_process(), and CVE-2026-64208 improves crypto/krb5 and rxrpc by adding pre-decrypt/pre-verify length checks. Finally, CVE-2026-64239 cleans up DAMON sysfs tried regions.
These vulnerabilities were all resolved in a single coordinated disclosure on July 25, 2026. Users of the Linux kernel are advised to update to the latest versions to incorporate these numerous security and stability fixes across a wide array of subsystems. The comprehensive nature of this batch underscores the continuous security maintenance required for a complex system like the Linux kernel.
The fixes are available in kernel version 6.9.3.
CVE-2026-64250, CVE-2026-64218, CVE-2026-64213, CVE-2026-64230, CVE-2026-64210, CVE-2026-64215, CVE-2026-64233, CVE-2026-64212, CVE-2026-64232, CVE-2026-64252, CVE-2026-64237, CVE-2026-64242, CVE-2026-64220, CVE-2026-64248, CVE-2026-64225, CVE-2026-64245, CVE-2026-64224, CVE-2026-64223, CVE-2026-64234, CVE-2026-64229, CVE-2026-64253, CVE-2026-64208, CVE-2026-64239, CVE-2026-64235, CVE-2026-64222.