https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:27:54 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-74672 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-74672 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1090 certfr-2026-avi-1090 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1090 https://cve.radiocsirt.org/vuln/euvd-2026-357930 EUVD-2026-357930 https://cve.radiocsirt.org/vuln/euvd-2026-357930 https://cve.radiocsirt.org/vuln/fkie_cve-2026-74672 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF</p> <p>Patch series &#34;mm: fix UAF caused by race between ptdump and vmap pgtable freeing&#34;, v6.</p> <p>Kernel page table walkers fall into two broad categories - those ranges where no exclusion is required via walk_kernel_page_table_range_lockless() and those where exclusion is required via walk_kernel_page_table_range() or walk_page_range_debug().</p> <p>The former category is used only by arm64 arch code operating on ranges it both wholly owns and does not concurrently write.</p> <p>The latter category consists of kernel page table walkers operating on ranges that are wholly owned (but which need exclusion against concurrent writers).</p> <p>The lock used for exclusion is the mmap lock, and for kernel ranges this is the mmap lock on init_mm.</p> <p>ptdump is a special case being both the only user of walk_page_range_debug(), and the only case in which it walks ranges it does not own.</p> <p>This presents a problem, as page tables may be freed under ptdump. And indeed there is a use-after-free bug in the kernel as a result, which this series addresses.</p> <p>vmap promotes page tables to huge leaf entries where possible, freeing the lower page table when it does. It does this with no meaningful locks held against concurrent ptdump walks.</p> <p>As a result, use-after-free can currently occur. This series addresses the issue by having the vmap huge promotion logic acquire the mmap read lock whi…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF</p> <p>Patch series &#34;mm: fix UAF caused by race between ptdump and vmap pgtable freeing&#34;, v6.</p> <p>Kernel page table walkers fall into two broad categories - those ranges where no exclusion is required via walk_kernel_page_table_range_lockless() and those where exclusion is required via walk_kernel_page_table_range() or walk_page_range_debug().</p> <p>The former category is used only by arm64 arch code operating on ranges it both wholly owns and does not concurrently write.</p> <p>The latter category consists of kernel page table walkers operating on ranges that are wholly owned (but which need exclusion against concurrent writers).</p> <p>The lock used for exclusion is the mmap lock, and for kernel ranges this is the mmap lock on init_mm.</p> <p>ptdump is a special case being both the only user of walk_page_range_debug(), and the only case in which it walks ranges it does not own.</p> <p>This presents a problem, as page tables may be freed under ptdump. And indeed there is a use-after-free bug in the kernel as a result, which this series addresses.</p> <p>vmap promotes page tables to huge leaf entries where possible, freeing the lower page table when it does. It does this with no meaningful locks held against concurrent ptdump walks.</p> <p>As a result, use-after-free can currently occur. This series addresses the issue by having the vmap huge promotion logic acquire the mmap read lock whi…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-74672 https://cve.radiocsirt.org/vuln/ghsa-h3pq-52v7-99m6 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF</p> <p>Patch series &#34;mm: fix UAF caused by race between ptdump and vmap pgtable freeing&#34;, v6.</p> <p>Kernel page table walkers fall into two broad categories - those ranges where no exclusion is required via walk_kernel_page_table_range_lockless() and those where exclusion is required via walk_kernel_page_table_range() or walk_page_range_debug().</p> <p>The former category is used only by arm64 arch code operating on ranges it both wholly owns and does not concurrently write.</p> <p>The latter category consists of kernel page table walkers operating on ranges that are wholly owned (but which need exclusion against concurrent writers).</p> <p>The lock used for exclusion is the mmap lock, and for kernel ranges this is the mmap lock on init_mm.</p> <p>ptdump is a special case being both the only user of walk_page_range_debug(), and the only case in which it walks ranges it does not own.</p> <p>This presents a problem, as page tables may be freed under ptdump. And indeed there is a use-after-free bug in the kernel as a result, which this series addresses.</p> <p>vmap promotes page tables to huge leaf entries where possible, freeing the lower page table when it does. It does this with no meaningful locks held against concurrent ptdump walks.</p> <p>As a result, use-after-free can currently occur. This series addresses the issue by having the vmap huge promotion logic acquire the mmap read lock whi…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF</p> <p>Patch series &#34;mm: fix UAF caused by race between ptdump and vmap pgtable freeing&#34;, v6.</p> <p>Kernel page table walkers fall into two broad categories - those ranges where no exclusion is required via walk_kernel_page_table_range_lockless() and those where exclusion is required via walk_kernel_page_table_range() or walk_page_range_debug().</p> <p>The former category is used only by arm64 arch code operating on ranges it both wholly owns and does not concurrently write.</p> <p>The latter category consists of kernel page table walkers operating on ranges that are wholly owned (but which need exclusion against concurrent writers).</p> <p>The lock used for exclusion is the mmap lock, and for kernel ranges this is the mmap lock on init_mm.</p> <p>ptdump is a special case being both the only user of walk_page_range_debug(), and the only case in which it walks ranges it does not own.</p> <p>This presents a problem, as page tables may be freed under ptdump. And indeed there is a use-after-free bug in the kernel as a result, which this series addresses.</p> <p>vmap promotes page tables to huge leaf entries where possible, freeing the lower page table when it does. It does this with no meaningful locks held against concurrent ptdump walks.</p> <p>As a result, use-after-free can currently occur. This series addresses the issue by having the vmap huge promotion logic acquire the mmap read lock whi…</p> https://cve.radiocsirt.org/vuln/ghsa-h3pq-52v7-99m6 https://cve.radiocsirt.org/vuln/msrc_cve-2026-74672 msrc_CVE-2026-74672 https://cve.radiocsirt.org/vuln/msrc_cve-2026-74672 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-74672 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:16.04:LTS: linux-hwe-edge and 245 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Patch series &#34;mm: fix UAF caused by race between ptdump and vmap pgtable freeing&#34;, v6. Kernel page table walkers fall into two broad categories - those ranges where no exclusion is required via walk_kernel_page_table_range_lockless() and those where exclusion is required via walk_kernel_page_table_range() or walk_page_range_debug(). The former category is used only by arm64 arch code operating on ranges it both wholly owns and does not concurrently write. The latter category consists of kernel page table walkers operating on ranges that are wholly owned (but which need exclusion against concurrent writers). The lock used for exclusion is the mmap lock, and for kernel ranges this is the mmap lock on init_mm. ptdump is a special case being both the only user of walk_page_range_debug(), and the only case in which it walks ranges it does not own. This presents a problem, as page tables may be freed under ptdump. And indeed there is a use-after-free bug in the kernel as a result, which this series addresses. vmap promotes page tables to huge leaf entries where possible, freeing the lower page table when it does. It does this with no meaningful locks held against concurrent ptdump walks. As a result, use-after-free can currently occur. This series addresses the issue by having the vmap huge promotion logic acquire the mmap read lock while both se…</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:16.04:LTS: linux-hwe-edge and 245 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Patch series &#34;mm: fix UAF caused by race between ptdump and vmap pgtable freeing&#34;, v6. Kernel page table walkers fall into two broad categories - those ranges where no exclusion is required via walk_kernel_page_table_range_lockless() and those where exclusion is required via walk_kernel_page_table_range() or walk_page_range_debug(). The former category is used only by arm64 arch code operating on ranges it both wholly owns and does not concurrently write. The latter category consists of kernel page table walkers operating on ranges that are wholly owned (but which need exclusion against concurrent writers). The lock used for exclusion is the mmap lock, and for kernel ranges this is the mmap lock on init_mm. ptdump is a special case being both the only user of walk_page_range_debug(), and the only case in which it walks ranges it does not own. This presents a problem, as page tables may be freed under ptdump. And indeed there is a use-after-free bug in the kernel as a result, which this series addresses. vmap promotes page tables to huge leaf entries where possible, freeing the lower page table when it does. It does this with no meaningful locks held against concurrent ptdump walks. As a result, use-after-free can currently occur. This series addresses the issue by having the vmap huge promotion logic acquire the mmap read lock while both se…</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-74672 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2970 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen oder vertrauliche Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen oder vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2970