Linux Kernel: 25 Vulnerabilities Across Subsystems Patched in Single Disclosure Event
Key findings • 25 Linux kernel vulnerabilities disclosed on August 15, 2026, patched same day. • Batch includes multiple rxrpc and afs networking subsystem flaws. • Graphics and accelerat…
Key findings
- 25 Linux kernel vulnerabilities disclosed on August 15, 2026, patched same day.
- Batch includes multiple rxrpc and afs networking subsystem flaws.
- Graphics and acceleration drivers (drm, amdxdna) also affected by several bugs.
- Vulnerabilities range from race conditions and memory leaks to NULL pointer dereferences.
- Users urged to update to the latest kernel version for security.
On August 15, 2026, a batch of 25 vulnerabilities was disclosed in the Linux kernel, impacting various subsystems including networking, graphics, and I/O memory management. These vulnerabilities, all patched on the same day, range in severity and could potentially lead to system instability, information disclosure, or denial-of-service conditions.
The disclosures highlight several distinct areas of concern within the kernel:
Networking Vulnerabilities (rxrpc, afs)
A significant portion of the batch, including CVE-2026-74438, CVE-2026-74436 through CVE-2026-74428, and CVE-2026-74415, relates to the rxrpc and afs subsystems. These vulnerabilities encompass issues such as race conditions in connection handling (CVE-2026-74436, CVE-2026-74435), use-after-free errors (CVE-2026-74433, CVE-2026-74428), NULL pointer dereferences (CVE-2026-74426, CVE-2026-74415), memory leaks (CVE-2026-74432, CVE-2026-74424), and improper handling of network packets (CVE-2026-74430, CVE-2026-74429). Specifically, CVE-2026-74438 addresses an insecure and unused random number generator in the crypto subsystem. The afs subsystem also saw fixes for network namespace teardown issues (CVE-2026-74427) and handling of callback requests (CVE-2026-74425).
Graphics and Acceleration Vulnerabilities (drm, accel)
Several vulnerabilities were found in the Direct Rendering Manager (DRM) and acceleration subsystems. CVE-2026-74423 and CVE-2026-74421 address memory leaks and incorrect data handling in the amdxdna acceleration driver, while CVE-2026-74422 and CVE-2026-74420 point to issues in the rockchip HDMI and DisplayPort drivers, respectively, related to memory allocation and VMAs. The radeon driver has fixes for integer overflows (CVE-2026-74417) and memory leaks during error handling (CVE-2026-74416). Additionally, CVE-2026-74419 adjusts data handling for copy_to_user() to prevent buffer overflows.
IOMMU and Other Subsystems
The IOMMU subsystem is affected by CVE-2026-74439, which describes a race condition in the virtual addressing translation when clearing the Present bit before tearing down context entries. The media subsystem has a fix for a potential deadlock in the UVC video driver (CVE-2026-74437). The dma-fence subsystem has a fix for potential NULL pointer dereferences in its tracing functions (CVE-2026-74418), and the fbcon driver has a fix for a NULL pointer dereference related to consoles without vc_data (CVE-2026-74416). Finally, CVE-2026-74415 addresses a use-after-free vulnerability in the atcspi200 SPI driver.
The swift disclosure and patching of these 25 vulnerabilities underscore the dynamic nature of kernel security. Users are advised to update to the latest kernel versions to incorporate these fixes. The broad range of affected subsystems indicates the importance of continuous vigilance and timely updates for maintaining a secure Linux environment.
CVE-2026-74439 CVE-2026-74438 CVE-2026-74437 CVE-2026-74436 CVE-2026-74435 CVE-2026-74434 CVE-2026-74433 CVE-2026-74432 CVE-2026-74431 CVE-2026-74430 CVE-2026-74429 CVE-2026-74428 CVE-2026-74427 CVE-2026-74426 CVE-2026-74425 CVE-2026-74424 CVE-2026-74423 CVE-2026-74422 CVE-2026-74421 CVE-2026-74420 CVE-2026-74419 CVE-2026-74418 CVE-2026-74417 CVE-2026-74416 CVE-2026-74415