Linux Kernel: 25 Vulnerabilities Disclosed, Including Critical NFS and BPF Flaws

Key findings

• 25 Linux kernel vulnerabilities disclosed on August 22, 2026, spanning critical and high severity ratings.
• Critical flaws found in NFS (CVE-2026-74730) and BPF (CVE-2026-74727) subsystems.
• Multiple networking components, including NFS, IPVS, BPF, and AF_XDP, affected by various flaws.
• Issues range from memory corruption (use-after-free, slab-out-of-bounds) to privilege escalation risks.
• Patches are available in updated Linux kernel releases, necessitating prompt system updates.
• A critical vulnerability in vdpa/mlx5 (CVE-2026-74712) was identified.

On August 22, 2026, a significant batch of 25 vulnerabilities was disclosed in the Linux kernel, affecting various subsystems and components. These vulnerabilities range in severity, with several rated as Critical (CVSSv3 9.8) and High (CVSSv3 7.1-8.4), indicating a broad impact on system security. The disclosures highlight issues in areas such as networking, storage, graphics, and general kernel operations, underscoring the complexity and interconnectedness of the Linux kernel.

Several vulnerabilities were identified in networking components. CVE-2026-74730, a Critical vulnerability in NFS, could lead to a use-after-free bug if a FREE_STATEID operation is delayed. The fix involves pinning the 'struct nfs_server' object. In the IPVS subsystem, CVE-2026-74724 (High severity) could allow a local attacker to cause an out-of-bounds write due to multiple reads of the IP header length field during packet processing. The bpf subsystem also saw multiple disclosures: CVE-2026-74720 (High) addresses a use-after-free in bpf_iter_tcp_established_batch(), while CVE-2026-74719 (Medium) fixes a qentry overwrite in smc_llc_event_handler(). Additionally, CVE-2026-74715 (High) resolves a netns reference imbalance in BPF conntrack kfuncs, and CVE-2026-74710 (High) enforces a minimum of 16 bytes for TX metadata in AF_XDP to prevent out-of-bounds reads. CVE-2026-74709 addresses a metadata pointer issue in XSK related to timestamps.

Storage and filesystem components were also affected. CVE-2026-74731 (High) in the sched_ext component addresses an issue with sub-scheduler teardown for never-linked sub-schedulers. The btrfs filesystem had multiple fixes: CVE-2026-74727 (Critical) prevents a slab-out-of-bounds read when processing inline LZO compressed file extents, CVE-2026-74711 (High) fixes a type confusion in the hwmon: (pmbus) notification logic, and CVE-2026-74713 (High) addresses bound map allocation issues in vhost_iotlb. CVE-2026-74721 (High) and CVE-2026-74718 (Medium) relate to the accel/amxdna component, with fixes for page-insertion errors and a locally exploitable BUG_ON, respectively. CVE-2026-74726 (High) in the bonding driver addresses a re-check of primary_is_promisc under RTNL. CVE-2026-74712 (Critical) fixes a buffer length issue in vdpa/mlx5's create_direct_keys(). CVE-2026-74732 (Medium) in drm/amd/display resolves a NULL pointer dereference on older timing generators. CVE-2026-74728 (Medium) in xfs handles NULL b_addr in xfs_buf_free to prevent dereferencing an invalid address. CVE-2026-74729 (Medium) fixes a usercopy overflow in soc: aspeed: lpc-snoop. CVE-2026-74723 (Critical) addresses a slab-out-of-bounds read in btrfs: lzo. CVE-2026-74722 (Medium) fixes a memory leak in btrfs_do_encoded_write().

Other vulnerabilities include CVE-2026-74733 (High) in gpio: pca953x concerning regmap lock handling, CVE-2026-74725 (High) in enic addressing a use-after-free on device removal, CVE-2026-74720 (High) in bpf: tcp fixing a use-after-free, and CVE-2026-74717 (High) in net/mlx5: fw_tracer ensuring proper handling of NULL returns on creation errors. CVE-2026-74716 (Medium) in accel/amdxdna fixes a locally exploitable BUG_ON. CVE-2026-74714 (High) addresses a use-after-free in bpf_iter_tcp_established_batch(). CVE-2026-74710 (High) in xsk requires at least 16 bytes of TX metadata.

The Linux kernel community has addressed these issues through patches integrated into subsequent kernel releases. Users are advised to update to the latest stable kernel versions to incorporate these security fixes. The broad range of affected subsystems highlights the importance of regular kernel updates and diligent security practices for all Linux systems.

The disclosures were made on a single day, August 22, 2026, indicating a coordinated disclosure event. While no specific threat actors or exploitation campaigns were mentioned in the provided details, the presence of critical vulnerabilities in core components like NFS and BPF warrants attention from system administrators and security professionals.

Key findings from this batch include:

• Critical vulnerabilities in NFS (CVE-2026-74730) and BPF (CVE-2026-74727) expose serious security risks.
• Multiple networking subsystems, including NFS, IPVS, BPF, and AF_XDP, were affected by various flaws.
• Filesystem and storage components like Btrfs and XFS also had critical and high-severity issues disclosed.
• The batch includes vulnerabilities related to memory corruption (use-after-free, slab-out-of-bounds) and privilege escalation.
• Fixes are available in updated Linux kernel releases, emphasizing the need for timely patching.
• A critical vulnerability in vdpa/mlx5 (CVE-2026-74712) was identified.

The Linux kernel is a foundational component of many operating systems, and the timely patching of these vulnerabilities is crucial for maintaining system integrity and security. Administrators should prioritize updating their systems to mitigate the risks associated with these disclosed flaws.

CVEs addressed in this disclosure include: CVE-2026-74733, CVE-2026-74732, CVE-2026-74731, CVE-2026-74730, CVE-2026-74729, CVE-2026-74728, CVE-2026-74727, CVE-2026-74726, CVE-2026-74725, CVE-2026-74724, CVE-2026-74723, CVE-2026-74722, CVE-2026-74721, CVE-2026-74720, CVE-2026-74719, CVE-2026-74718, CVE-2026-74717, CVE-2026-74716, CVE-2026-74715, CVE-2026-74714, CVE-2026-74713, CVE-2026-74712, CVE-2026-74711, CVE-2026-74710, CVE-2026-74709.