Linux Kernel: 25 Vulnerabilities Across Subsystems Disclosed and Patched Together
A batch of 25 Linux kernel vulnerabilities across various subsystems were disclosed and patched by Debian on July 20, 2026.
Key findings
- 25 Linux kernel vulnerabilities disclosed together on July 20, 2026, affecting multiple subsystems.
- All disclosed vulnerabilities were patched by Debian on the same day as disclosure.
- Vulnerabilities include buffer overflows, use-after-free errors, deadlocks, and null-pointer dereferences.
- The batch impacts networking, storage, hardware drivers, and file system components.
- No active exploitation or specific threat actors were mentioned in the disclosure.
- Updates to the Linux kernel are recommended to mitigate these risks.
On July 20, 2026, a batch of 25 vulnerabilities was disclosed in the Linux kernel, impacting a wide array of subsystems including networking, storage, hardware monitoring, and file systems. These vulnerabilities were all addressed in Debian's Linux kernel packages on the same day of disclosure. The disclosures collectively highlight potential issues such as buffer overflows, use-after-free errors, deadlocks, and null-pointer dereferences, underscoring the complexity and interconnectedness of the kernel's components.
Several vulnerabilities were found within the networking stack. CVE-2026-64057 addresses a fix for incorrect locking in the afs filesystem, which could lead to race conditions. CVE-2026-64069 and CVE-2026-64062 tackle issues in netfs, specifically concerning the cancellation of subrequests and potential deadlocks in write-through mode, respectively. The igc network driver is affected by CVE-2026-64035, which involves setting the transmit buffer type for SMD frames. Additionally, CVE-2026-64078 enhances netfilter by adding and using xtables_unregister_table_exit to properly detach tables from the packet path. CVE-2026-63803 fixes synchronization issues with per-protocol timers in hdlc_ppp before freeing hdlc state, and CVE-2026-64179 addresses potential memory leaks in the iosm module within the net:wwan subsystem. CVE-2026-64046 prevents chain-after-chain issues in plain text TLS, and CVE-2026-63970 corrects the binding of uargs before filling zerocopy skbs in vsock/virtio. Finally, CVE-2026-64054 rejects duplicate leaves in GROUP requests for the net:shaper module.
Storage and file system related vulnerabilities include CVE-2026-53381, a fix for a use-after-free error on submount unmount in virtiofs, and CVE-2026-53395, which corrects a dead ACL conflict guard in nfsd4_create. CVE-2026-63894 addresses a serialization issue for DMABUF cancel against request completion in usb: gadget: f_fs. The dma-buf subsystem is affected by CVE-2026-63910, a use-after-free error in the dma_buf_fd() tracepoint.
Hardware and driver-related issues span several subsystems. CVE-2026-64135 resolves a buffer overflow in the hwmon: pmbus/adm1266 driver. CVE-2026-63965 fixes a stack leak in the iio: pressure: bmp280 driver's trigger handler. CVE-2026-63835 prevents OGM aggregation on disabled hardifs in batman-adv. CVE-2026-63823 ensures the request_key_auth payload is pinned in instantiate paths. CVE-2026-63887 addresses a buffer overflow in the scsi: target: iscsi module's text output encoding. CVE-2026-64107 corrects a null-pointer dereference in the ASoC: codecs: pcm512x driver. CVE-2026-63930 fixes a use-after-free error in the iio: buffer: hw-consumer error path. CVE-2026-64104 explicitly leaks pages in an unknown state in virt: sev-guest when memory encryption/decryption functions fail. CVE-2026-63959 validates RX headers against byte counts in usb: typec: tcpm/tcpci_maxim. CVE-2026-63831 adds skb_cow_data() before in-place crypto operations in mac802154: llsec.
The disclosures, which occurred on July 20, 2026, were all patched on the same day by Debian. While no active exploitation or specific threat actors were mentioned in the disclosures, the breadth of affected subsystems highlights the importance of timely updates. Users of Debian's Linux kernel packages are advised to apply the provided updates to mitigate these risks.
The batch of vulnerabilities, totaling 25, were all disclosed and patched on July 20, 2026, affecting numerous subsystems within the Linux kernel. The rapid patching by Debian indicates a coordinated disclosure and response. Users are strongly recommended to update their systems to the latest available kernel versions to address these security concerns.
Key findings from this batch include:
- A large set of 25 vulnerabilities affecting diverse Linux kernel subsystems were disclosed on July 20, 2026.
- All disclosed vulnerabilities were addressed in Debian's Linux kernel packages on the same day.
- Vulnerabilities span various bug classes including buffer overflows, use-after-free errors, deadlocks, and null-pointer dereferences.
- No active exploitation or specific threat actors were mentioned in the disclosure.
- Updates to the Linux kernel are recommended to mitigate these risks.
- The disclosures impacted networking, storage, hardware drivers, and file system components.
- Specific issues include incorrect locking, stack leaks, and memory management flaws.
- The batch demonstrates the ongoing need for vigilance and prompt patching in kernel security.