The Linux kernel project published 227 Linux kernel CVEs in the week of 23 to 29 August 2026. That is about five times a normal week, because a full stable cycle landed on 28 August and the records for everything in it were published together. Most are already fixed in current upstream stable releases, but four of the records below name no fix for branches they mark as affected, so the branch update alone does not clear those four. None of the records notes known exploitation, and no public exploit code was found for any of them at the time of writing. The minimum safe upstream release per branch is 5.10.268, 5.15.219, 6.1.186, 6.6.155, 6.12.107, 6.18.48, 7.1.12, 7.2.2, or mainline 7.2.
Last week this series covered six CVEs. This week it is 227. The jump is not a sudden collapse in kernel quality. The CVE IDs show what happened: 21 sit in the CVE-2026-747xx block and 206 in the CVE-2026-805xx to 807xx block, and on 28 August the kernel project cut a new point release on every active branch at once.
Where this advisory quotes a CVSS score, that score is the kernel CNA's own secondary metric; NVD has not finished analysing this batch, so other databases may publish different figures later. Prioritise by reachability and deployment context rather than by CVSS alone.
The one action: update to the fixed version for your branch
raghu@techveda.org:~$ uname -r
6.6.152-lts
| Stable branch | Update to at least | Notes |
|---|---|---|
| 5.10 LTS | 5.10.268 |
CVE-2026-80590 sets this point release. Four records below name no 5.10 fix. |
| 5.15 LTS | 5.15.219 |
CVE-2026-80590 sets this. Same four gaps as 5.10. |
| 6.1 LTS | 6.1.186 |
CVE-2026-80590 sets this. Two of the four gaps apply. |
| 6.6 LTS | 6.6.155 |
CVE-2026-80590 sets this. One gap: CVE-2026-74752. |
| 6.12 LTS | 6.12.107 | Same as 6.6. |
| 6.18 LTS | 6.18.48 | Same as 6.6. |
| 7.1 stable | 7.1.12 | Clears every record discussed below. |
| 7.2 stable | 7.2.2 | New row this week. Mainline 7.2 shipped 16 August and now has a stable branch. |
| mainline | 7.2 | Released 16 August 2026. |
All eight stable targets are the newest release of their branch and all eight were cut on 28 August, so on an upstream kernel the check is simple: if you are not on the current release for your branch, you are behind. One record, CVE-2026-80590 (stale GSO state on IPv4 fragments), sets the target on all eight branches by itself and names no mainline fix.
Four records the branch update does not clear
This is the part to read before you close the ticket.
| CVE | Introduced | Fixed in | Affected, NO fix named |
|---|---|---|---|
CVE-2026-74752 (SCTP, 9.8) |
2.6.24 | 7.1.10, mainline 7.2 | 5.10, 5.15, 6.1, 6.6, 6.12, 6.18 |
CVE-2026-80551 (vfio-ccw, 9.3) |
5.3 | 6.6.154 and later | 5.10, 5.15, 6.1 |
CVE-2026-74743 (macvlan, 9.8) |
2.6.23 | 6.1.184 and later | 5.10, 5.15 |
CVE-2026-80635 (wcn36xx) |
4.7 | 6.1.178 and later | 5.10, 5.15 |
Last week's CVE-2026-74582 is also still unfixed on 5.10, 5.15 and 6.1. If you ship an older LTS branch you now have five open items to track separately from the branch bump.
Last week's targets were 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9 and mainline 7.2. Every branch moved up exactly three point releases on 28 August.
On a vendor or BSP kernel the version string will not compare cleanly with the table. A kernel reporting 5.10.110-rk3588 will not become 5.10.268 by any upstream update you apply yourself. Ask your vendor to confirm, and treat a verified backport as equivalent. Until an update is possible, reduce exposure by disabling unused features, restricting the relevant privileges, and documenting residual risk through your product security process.
Mobile and automotive
CVE-2026-80707: CAN J1939 receive buffer was not zeroed
J1939 is the transport protocol on heavy vehicles and agricultural equipment. A new receive session's buffer was allocated but not zeroed, so any part the peer never wrote kept residual kernel memory. The fix zeroes it in j1939_session_fresh_new(). The record states the residual-data problem and the fix; a readback path is our inference, not the record's claim. Affects 4.19+. Gate CONFIG_CAN_J1939. Fixed 5.10.265 → mainline 7.2. Record
CVE-2026-74737: TI AM65 Ethernet used hardware-reserved bits as part of a port index
Only the lower 8 bits of the 16-bit Source Tag carry the MAC port ID; the upper 8 are hardware-reserved and hold an arbitrary value, and the driver used the whole field as an index. The record reports sporadic kernel crashes. The fix masks the tag to its lower 8 bits.
Read the scoring carefully: the record carries CVSS 9.8 with a network attack vector, but its own description attributes the invalid index to hardware-reserved bits rather than attacker-chosen packet content — a reliability defect with a high score rather than a demonstrated remote attack. Gate CONFIG_TI_K3_AM65_CPSW_NUSS. Fixed on all seven stable branches that name a fix, from 5.10.266, plus mainline 7.2. Record
CVE-2026-80722: mac80211 partially validated an S1G TWT setup frame
ieee80211_process_rx_twt_action() only partially validates a received S1G TWT setup frame, so an individual agreement can reach ieee80211_s1g_rx_twt_setup() with twt->length too short for the full params struct. The driver callback and tracepoint then read the complete block. Broadcast agreements are unaffected. Note the S1G qualifier — this is the sub-1GHz path. The affected file has no config option of its own, so it is present wherever mac80211 is built. Affects 5.15+. Gate CONFIG_MAC80211. Fixed 5.15.216 → mainline 7.2. Record
CVE-2026-80721: Bluetooth ISO could leave a dangling connection pointer
Clearing iso_conn::hcon depended on iso_conn_del() happening to drop the last reference. The fix clears conn->hcon explicitly. Isochronous channels carry LE Audio. One of four Bluetooth records this week, with CVE-2026-80692, CVE-2026-80683 and CVE-2026-80666 — all connection-object lifetime issues. Affects 6.0+. Gate CONFIG_BT plus CONFIG_BT_LE. Fixed 6.18.44, 7.1.8, mainline 7.2. Record
Embedded and IoT
CVE-2026-74746: use-after-free in the netfilter flow table
GC could free a flow entry while flow_offload_add() was still inserting it. KASAN reports slab-use-after-free reads and writes. The fix publishes the GC-visible tuple last. Highest priority for anyone running a Linux gateway or router — the trigger is ordinary forwarded traffic once flow offload is enabled. CVSS 9.8, affects 5.13+. Gate CONFIG_NF_FLOW_TABLE. Fixed on all seven stable branches that name a fix, from 5.10.266, plus mainline 7.2. Record
CVE-2026-80603: off-by-one read in the netfilter IRC helper corrupts DCC expectations
parse_dcc() read one byte past the region filled by skb_header_pointer(). The record is explicit that this is not currently an OOB read — the buffer is allocated one byte over — so the real impact is a stale byte consumed by simple_strtoul, producing a wrong DCC IP or port in the conntrack expectation. A firewall induced to open the wrong data connection, not memory corruption. Easy to remove rather than patch. Affects 2.6.12+. Gate CONFIG_NF_CONNTRACK_IRC. Fixed 5.10.261 → mainline 7.2. Record
CVE-2026-80635: out-of-bounds read from a short firmware response in wcn36xx
A shorter-than-expected trigger block-ack response from the Wi-Fi firmware was not rejected, so the parser reads a 22-byte struct past the end. The input is the firmware response, not network traffic. Affects 4.7+. No fix named for 5.10 or 5.15. Gate CONFIG_WCN36XX. Fixed 6.1.178 → mainline 7.2. Record
CVE-2026-80723: out-of-bounds write when the boot device tree declares too many reserved regions
On boot, fdt_scan_reserved_mem() saves each dynamically-placed reserved-memory subnode into a fixed-size local array without bounding the count. This is embedded-specific in a way most kernel CVEs are not: the count comes from whatever FDT the platform hands the kernel at boot, so if your boot chain composes the tree from a base plus overlays, or a carrier board contributes nodes, it is not something you control at build time. Overlays applied later at runtime do not go through this path. Affects 3.15+. Gate CONFIG_OF_RESERVED_MEM. Fixed 6.12.103 → mainline 7.2. Record
Cloud and datacenter
CVE-2026-80551: s390 vfio-ccw double-fetch of the first IDAW
The host reads the first indirect address word to size a buffer, then reads it again while filling it, with nothing guaranteeing the value is the same. A guest that changes it in between makes the host size one buffer and fill another. CVSS 9.3, guest-to-host.
One of nine vfio-ccw records (CVE-2026-80547…80555); all nine carry a CVSS vector with scope marked as changed. CVE-2026-80554 (unbounded recursion processing channel programs) is the other CRITICAL at 9.3. Treat the nine as one unit. Affects 5.3+. No fix named for 5.10, 5.15 or 6.1. Gate CONFIG_VFIO_CCW. Fixed 6.6.154 → mainline 7.2. Record
CVE-2026-80590: stale GSO state left on IPv4 fragments before reassembly
Reassembled packets carried segmentation offload metadata that no longer described them. No CVSS score and no dramatic description, but it is the record that matters most to the table above: fixed on every stable branch, no mainline entry, and its fixed versions are exactly this week's eight targets. Fixed in 5.10.268, 5.15.219, 6.1.186, 6.6.155, 6.12.107, 6.18.48, 7.1.12 and 7.2.2. Record
CVE-2026-74743: macvlan did not inherit headroom from the lower device
The transmit path can underflow reserved skb headroom, which KASAN reports as a slab use-after-free. The precondition decides whether you are affected at all: the record names macsec, IPsec, WireGuard, tunnels, and veth with rx headroom as lower devices requiring extra space. A macvlan over a plain physical NIC is not in scope. CVE-2026-74744 is the identical fix in ipvlan at the same 9.8. Affects 2.6.23+. No fix named for 5.10 or 5.15. Gate CONFIG_MACVLAN. Fixed 6.1.184 → mainline 7.2. Record
CVE-2026-74752: SCTP restored AUTH fields straight from peer-controlled cookie bytes
When cookie authentication is disabled, a COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled bytes with no validation. A forged RANDOM length gives OOB reads; a forged HMAC identifier caused a 32-byte write past a zero-length AUTH chunk — which the record describes as a primitive for a local privilege escalation chain, despite the CVSS 9.8 / PR:N score. Affects 2.6.24+. This is the widest gap this week: no fix named for 5.10, 5.15, 6.1, 6.6, 6.12 or 6.18. Gate CONFIG_IP_SCTP. Fixed in 7.1.10 and mainline 7.2 only. Record
CVE-2026-80586: MPTCP processed a second suboption against leftover state
A peer can send a malformed DSS with a wrong size followed by another DSS, or MPC plus data, in the same packet. The malformed suboption is ignored but leaves fields written, so the second is processed against leftover state — inconsistency or reads of uninitialised data. One of four MPTCP records, with CVE-2026-80587 (9.8), CVE-2026-80585 (9.4) and CVE-2026-80588. Affects 5.11+. Gate CONFIG_MPTCP. Fixed 5.10.266 → mainline 7.2. Record
CVE-2026-80557: out-of-bounds read decoding a Ceph watcher list
The record gives an unusually explicit attacker model: a malicious or compromised OSD in a multi-tenant Ceph deployment can trigger this against any kernel client that calls CEPH_OSD_OP_LIST_WATCHERS, with no privileges beyond OSD session establishment. Two more libceph records are the same class — CVE-2026-80558 and CVE-2026-80561, all three at 9.8 — plus CVE-2026-80528 in the Ceph fs client, which needs another mounted ext4 filesystem in play. Affects 3.10+. Gate CONFIG_CEPH_LIB. Fixed 5.10.267 → mainline 7.2. Record
CVE-2026-80713: io_uring dropped per-task restrictions on exec
A task can install io_uring restrictions that apply to every ring it creates. The exec cancellation path called __io_uring_free(), which freed the per-task restriction along with the task context, so any ring created after the exec came up unrestricted. Not memory corruption — a confinement bug: a limit that was applied is silently no longer applied. Affects 5.10+. Gate CONFIG_IO_URING. Fixed 7.1.8, mainline 7.2. Record
Medical devices
-
Wireless.
CVE-2026-80721and the three other Bluetooth records (80692,80683,80666) matter for wearables, patient monitors and hearing devices, LE Audio specifically.CVE-2026-80722matters on hospital wireless networks, but only where the sub-1GHz S1G path is in use. -
Network protocols. DICOM/HL7/FHIR-over-IP devices should review
CVE-2026-74752andCVE-2026-80717, and note the first is unfixed on every LTS branch below 7.1. Devices on TI AM65/Sitara parts should reviewCVE-2026-74737. -
Removable media. A large crafted-image filesystem group:
CVE-2026-80672,CVE-2026-80673,CVE-2026-80674(NTFS),CVE-2026-80598(NTFS3),CVE-2026-80631(btrfs),CVE-2026-80656(HFS+),CVE-2026-80591(f2fs). Relevant to any device that auto-mounts a USB stick for patient data.
Patching a medical device is not the same as patching a server. The update has to pass validation and regulatory revalidation under US FDA postmarket cybersecurity guidance, the EU Medical Device Regulation (MDR) and IEC 62304. Plan the stable kernel update through the manufacturer's change-control process.
How to check which Linux kernel CVEs apply to you
Version. uname -r against the table. Then read the four-gap list, because on 5.10, 5.15 and 6.1 the branch target is not the whole answer.
Configuration.
raghu@techveda.org:~$ zcat /proc/config.gz | grep -E '^(# )?CONFIG_(MAC80211|BT|NF_FLOW_TABLE|IP_SCTP|MACVLAN|IO_URING)[ =]'
CONFIG_MAC80211=m
CONFIG_BT=m
CONFIG_NF_FLOW_TABLE=m
CONFIG_IP_SCTP=m
CONFIG_MACVLAN=m
CONFIG_IO_URING=y
The pattern is anchored on purpose — a plain grep CONFIG_BT also matches CONFIG_BTRFS_FS. Other symbols worth checking: CONFIG_CAN_J1939, CONFIG_TI_K3_AM65_CPSW_NUSS, CONFIG_BT_LE, CONFIG_NF_CONNTRACK_IRC, CONFIG_WCN36XX, CONFIG_OF_RESERVED_MEM, CONFIG_VFIO_CCW, CONFIG_IPVLAN, CONFIG_MPTCP, CONFIG_CEPH_LIB. Read =m as present-and-loadable, not absent.
Reachability. The records describe code paths, not attacker models, so this ordering is our reading and not a statement from the kernel CVE team. Untrusted guests: the vfio-ccw group. Gateway or router: CVE-2026-74746. Storage client: the libceph group. Radio or bus: CVE-2026-80722, the Bluetooth group, CVE-2026-80707. Then remote protocol records, then local confinement (CVE-2026-80713), then configuration- and image-gated. Cutting across all of it: if you run 5.10, 5.15 or 6.1, the four unfixed records outrank everything, because no update clears them.
Key takeaways
- Update to the target release for your branch: 5.10.268, 5.15.219, 6.1.186, 6.6.155, 6.12.107, 6.18.48, 7.1.12, 7.2.2, or mainline 7.2 — all the newest release of their branch, all cut on 28 August.
-
The branch update does not clear everything.
CVE-2026-74752,CVE-2026-80551,CVE-2026-74743andCVE-2026-80635each mark a branch affected and name no fix. On 5.10/5.15 all four apply; on 6.1 two; on 6.6/6.12/6.18 one. - Last week's
CVE-2026-74582is also still unfixed on 5.10, 5.15 and 6.1 — five open items on older LTS. - 227 is a release cadence, not a collapse in kernel quality.
- There is a new 7.2 stable branch; 7.2.2 is the newest stable kernel.
- None of the records notes known exploitation, and no public exploit code was found at the time of writing. That is a point-in-time check, not a guarantee.
Top comments (0)