Linux Kernel: 25 Vulnerabilities Across Subsystems Disclosed Together

Key findings

25 Linux kernel vulnerabilities disclosed together on July 26, 2026, affecting diverse subsystems.
Issues span memory management, networking, USB, and cryptography, requiring prompt updates.
Vulnerabilities include resource leaks, improper access controls, and potential denial-of-service vectors.
Specific components like ksmbd, iommufd, and various USB drivers are addressed.
All disclosed vulnerabilities were fixed in a single, unified kernel update.

On July 26, 2026, a batch of 25 vulnerabilities was disclosed in the Linux kernel, all fixed in the same update. These vulnerabilities span various subsystems, including networking, USB, memory management, and cryptography, indicating a broad range of potential impacts.

Several vulnerabilities relate to memory management and resource handling:

CVE-2026-64295 addresses an issue in mm/page_ext where an iteration API could lead to invalid PFN access due to a lack of count limits.
CVE-2026-64368 modifies the behavior of mm/slab to ensure proper zeroing of memory when requested, preventing potential information leaks.
CVE-2026-64292 and CVE-2026-64291 both highlight vulnerabilities in iommufd related to veventq memory allocation. Userspace could exhaust kernel memory by allocating excessively large queues, with CVE-2026-64292 specifically moving allocation outside a spinlock and CVE-2026-64291 setting an upper bound for veventq_depth.
CVE-2026-64509 in the rust subsystem fixes GenDisk cleanup paths, preventing leaks of temporary gendisk and request_queue data.
CVE-2026-64301 resolves an of_node refcount leak in the regulator: scmi driver.

Networking and USB subsystems were also affected:

CVE-2026-64423 in ipv4: igmp removes multicast groups from hash tables upon device destruction, resolving a potential issue during device removal.
CVE-2026-64394 and CVE-2026-64397 address vulnerabilities in the ksmbd component. CVE-2026-64394 adds a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY, while CVE-2026-64397 serializes QUERY_DIRECTORY requests per file to prevent data races.
Several USB-related vulnerabilities were patched, including CVE-2026-64338 (unregistering parport on probe failure in uss720), CVE-2026-64505 (adding a length check for the RNDIS header), CVE-2026-64348 (freeing ISO schedules on failed submits), and CVE-2026-64330 (validating SVID index in tcpm).
CVE-2026-64351 in net: usb: kalmia bounds the RX frame length to prevent potential issues with malformed USB packets.

Other notable vulnerabilities include:

CVE-2026-64265 in fuse clears intr_entry in fuse_resend and fuse_remove_pending_req to prevent race conditions.
CVE-2026-64477 in x86,fs/resctrl prevents out-of-bounds access when offlining CPUs with SNC enabled.
CVE-2026-64309 in crypto: ccp prevents the initialization of SNP for ioctl(SNP_COMMIT) under certain conditions, avoiding potential issues with SEV initialization failures.
CVE-2026-64475 in vfio/pci ensures the VGA arbiter client is released on register_device() failure.

The disclosure of these 25 vulnerabilities on a single day highlights the importance of timely patching for the Linux kernel. Users are advised to update to the latest stable kernel version to incorporate these fixes and mitigate potential security risks across a wide array of system functionalities. The broad scope of these issues underscores the complexity of kernel development and the continuous need for security vigilance.