Linux Kernel: 25 Vulnerabilities Across Subsystems Disclosed Together
Key findings • 25 vulnerabilities disclosed in the Linux kernel on July 20, 2026. • Issues span multiple subsystems including networking, storage, graphics, and security. • All disclosed …
Key findings
- 25 vulnerabilities disclosed in the Linux kernel on July 20, 2026.
- Issues span multiple subsystems including networking, storage, graphics, and security.
- All disclosed vulnerabilities have been addressed in Debian's Linux kernel packages.
- No active exploitation or specific threat actors were mentioned in the disclosure.
- Updates to the Linux kernel are recommended to mitigate these risks.
On July 20, 2026, a batch of 25 vulnerabilities was disclosed in the Linux kernel, all addressed in Debian's Linux kernel packages. These vulnerabilities span various subsystems, including storage, networking, graphics, and security modules, indicating a broad range of potential issues within the kernel's complex architecture. The timely disclosure and resolution of these issues highlight the ongoing efforts to maintain the security and stability of the Linux operating system.
Several vulnerabilities were identified in the storage subsystem. CVE-2026-53390 addresses an out-of-bounds read in the ksmbd module's smb_check_perm_dacl() function, which could allow for information disclosure. In the SCSI target, CVE-2026-63888 fixes two bugs—a CRC overread and a double-free—in the iscsit_handle_text_cmd() function related to iSCSI Text-phase commands. CVE-2026-63889 and CVE-2026-64100, related to SCSI and graphics respectively, also involve potential memory corruption or stability issues. Specifically, CVE-2026-63889 widens a counter in scsi_transport_fc to prevent potential issues with Fibre Channel fabric actors, while CVE-2026-64100 resolves a shrinker deadlock in the drm/msm driver under specific memory reclaim conditions. Additionally, CVE-2026-63954 corrects a crash in the HPFS filesystem module if hpfs_map_dnode_bitmap fails, and CVE-2026-64068 introduces necessary locking in the netfs module to prevent race conditions when retrying subrequests.
The networking stack also saw several disclosures. CVE-2026-63870 restricts the ieee802154 driver to only accept IPv6 packets in lowpan_xmit(), preventing potential issues with non-IPv6 packets on 6LoWPAN interfaces. CVE-2026-64086 includes the PEC byte in the read buffer for the hwmon pmbus/adm1266 driver to correctly handle block transfers. CVE-2026-64164 fixes a sleep-while-in-atomic context issue in btrfs_sync_file() related to tracepoints, and CVE-2026-63859 adds missing bits to airoha_qdma_cleanup_tx_queue() to properly reset DMA TX descriptors. CVE-2026-64137 enhances security for the CIFS SWN netlink command by requiring network administrator privileges, and CVE-2026-64025 resolves a race condition between BPF and skmsg concerning verdict sk_data_ready and TLS RX.
Several vulnerabilities were found in graphics and display drivers. CVE-2026-64100, mentioned earlier, fixes a deadlock in drm/msm. CVE-2026-64097 adds validation for the GPIO pin LUT table size in drm/amd/display to prevent issues when iterating over VBIOS tables. CVE-2026-64099 addresses a use-after-free vulnerability in the drm/v3d driver concerning CPU job query arrays on the error path.
Other notable disclosures include issues in memory management, device probing, and security modules. CVE-2026-53403 fixes a null-pointer dereference in fbdev related to video mode lists. CVE-2026-53400 resolves a race condition during adapter registration in the i2c core. CVE-2026-63893 and CVE-2026-63892 address issues in the thunderbolt driver, specifically rejecting u32 wrap in tb_property_entry_valid() and preventing size_t underflow by rejecting small dir_len values. CVE-2026-64176 fixes driver-set TX rates on older iwlwifi devices. CVE-2026-64087 rejects implausible record_count values in the hwmon pmbus/adm1266 driver's nvmem_read_blackbox function. CVE-2026-63950 initializes nr_pages correctly in mm/rmap to prevent incorrect page counts. CVE-2026-64022 ensures the software node is destroyed when deactivating an aggregator in the gpio subsystem. CVE-2026-64111 extends mutex protection for lsm_set_self_attr(). CVE-2026-64194 ensures that KVM SEV ignores Port I/O requests of length '0'. Finally, CVE-2026-64071 fixes a use-after-free in nvme-pci related to host memory buffer management.
All 25 vulnerabilities were resolved in the Debian Linux kernel packages, and users are advised to update to the latest available versions to mitigate these security risks. The broad nature of these fixes underscores the importance of regular kernel updates for maintaining a secure computing environment.
The disclosures were made on July 20, 2026, and all appear to be resolved in the same update cycle. No specific threat actors or active exploitation campaigns were mentioned in the provided details.
The vulnerabilities were disclosed on July 20, 2026. All issues appear to have been addressed in the same update cycle for Debian's Linux kernel packages. Users should update to the latest available kernel version.