Linux Kernel: 25 Vulnerabilities Across Subsystems Disclosed Together, Patched in Single Update
A batch of 25 Linux kernel vulnerabilities, affecting diverse subsystems, was disclosed and patched together in version 6.9.3.
Key findings
- 25 Linux kernel vulnerabilities disclosed together between July 26-28, 2026, patched in version 6.9.3.
- Vulnerabilities span diverse subsystems including networking, memory management, USB, and cryptography.
- Key issues include null-pointer dereferences, use-after-free flaws, and out-of-bounds reads.
- The disclosure highlights coordinated security efforts within the Linux kernel community.
- Fixes address resource leaks, improper access controls, and potential denial-of-service vectors.
On July 26-28, 2026, a significant batch of 25 vulnerabilities was disclosed in the Linux kernel, affecting a wide array of subsystems. These vulnerabilities, patched in a single kernel update (version 6.9.3 according to related reporting), span networking, memory management, USB, cryptography, and more, highlighting the ongoing security efforts within the Linux kernel community.
Networking Vulnerabilities
Several vulnerabilities were found within the networking stack. CVE-2026-64538 addresses a null-pointer dereference in fib6_nh_mtu_change() within the IPv6 subsystem. CVE-2026-64550 fixes a validation issue in the rmnet driver for MAP frame lengths. The bridge subsystem is affected by CVE-2026-64537, which rejects invalid CCM intervals, and CVE-2026-64554, which corrects a stale pointer in br_ip6_fragment().
Further networking issues include CVE-2026-64548, which rejects overflowing copy operations in bpf_msg_push_data(), and CVE-2026-64545, which adds a NULL check for the master device in xdp_master_redirect(). CVE-2026-64553 addresses an information leak in net: psample, and CVE-2026-64541 resolves a use-after-free flaw in net/smc's smc_cdc_rx_handler(). CVE-2026-64530 handles TC_ACT_CONSUMED in tcf_qevent_handle, and CVE-2026-64543 fixes a use-after-free in tipc_disc_rcv(). CVE-2026-64549 avoids an out-of-bounds read in the Bluetooth bpa10x driver, and CVE-2026-64539 corrects a stack out-of-bounds write in Bluetooth EIR advertising data. CVE-2026-64546 fixes an out-of-bounds read in drm/edid's drm_parse_tiled_block(). CVE-2026-64540 addresses an out-of-bounds read in the usbnet: gl620a driver. Finally, CVE-2026-64338 ensures the uss720 USB driver unregisters its parport on probe failure.
Memory Management and BPF
Memory management vulnerabilities include CVE-2026-64295, which adds a count limit to page_ext_iter_next to prevent invalid PFN access, and CVE-2026-64509, which fixes GenDisk cleanup paths in the Rust implementation. CVE-2026-64291 addresses an upper bound for veventq_depth in iommufd to prevent kernel memory exhaustion.
Other Subsystems
The batch also includes vulnerabilities in other areas. CVE-2026-64544 fixes an out-of-bounds read in the crypto: asymmetric_keys module. CVE-2026-64555 corrects SPSR_EL2 restore in KVM for arm64. CVE-2026-64394 adds necessary permission checks to the ksmbd component for SMB2_SET_INFO with WRITE_DAC/WRITE_OWNER operations. CVE-2026-64423 removes multicast groups from the hash table upon device destruction in the IPv4 IGMP subsystem. CVE-2026-265 clears intr_entry in fuse_resend and fuse_remove_pending_req. CVE-2026-64301 fixes an of_node refcount leak in the regulator: scmi driver. CVE-2026-14040 increases the weight to u16 in the net: nexthop module.
Response and Impact
All 25 disclosed vulnerabilities were addressed in a single kernel update, version 6.9.3. This coordinated disclosure, spanning July 26-28, 2026, highlights the Linux kernel community's commitment to security. Users are advised to update to the patched version to mitigate potential risks, which include resource leaks, improper access controls, and denial-of-service vectors across various subsystems.
The broad range of affected components underscores the importance of timely kernel updates for maintaining system security and stability. The fixes address critical issues in networking, memory management, and other core functionalities.