Linux Kernel CVEs: What to Patch by Device (9 – 15 Aug 2026)

This is a very large week by count, but it is not a crisis week. The CVE IDs show what happened. About 400 sit in the CVE-2026-68xxx block, about 490 in the 72xxx block, and about 190 in the 74xxx block, with a few much older outliers such as CVE-2026-31404. These are identifiers assigned over many months and published together. Because the assignments are old, the fixes shipped in earlier stable point releases than the ones on kernel.org today. This is a catch-up publication, not a week in which 1,086 new bugs were found.

Most of these Linux kernel CVEs are narrow driver and networking fixes. Which ones matter for you depends on what your product builds and how it is configured. No CVE this week has public exploit code or a CVSS score in the kernel record, so the order of work is set by how the bug is reached. A few are reachable over the air or over the network, so schedule those first where they apply. This advisory gives the version to install, then explains which CVEs matter for mobile and automotive, embedded and IoT, cloud and datacenter, and medical devices. Each CVE below has its own heading so you can link straight to it.

The one action: update to the fixed version for your branch

Run uname -r to see your current kernel version. Compare it with the target for your branch in the table below. If your version is lower than the target, update to the target release or newer.

raghu@techveda.org:~$ uname -r
6.6.140-lts

In that example the running kernel is 6.6.140, which is below the 6.6 target of 6.6.145, so the system needs an update.

Other branches were not affected this week, or their fix was released before this window, with one exception. The 6.19 and 7.0 series are end of life and get no table row, but CVE-2026-72463 marks both as affected and names no fix for either. If you still run 6.19 or 7.0, the answer for that CVE is to move to 7.1.5 or newer. Every target in the table is a release that already exists, so nothing here waits on a future stable release. We checked 49 of the CVE records directly, covering the whole high-impact set plus a sample spread evenly across the ID range, and every record named the same fixed version for a given branch. That is why one version per branch covers almost all of the batch.

One point is worth stating plainly. The targets above are lower than the ones in last week’s advisory, which asked for 5.10.264, 5.15.215, 6.1.182, 6.6.150, 6.12.102, 6.18.43 and 7.1.7. That is expected. These are older assignments, so their fixes were released in earlier point releases. If you already applied last week’s targets, almost all of this batch needs no further work. The two exceptions below still apply, because they are not fixed on every branch.

Mobile and automotive

The wireless fixes matter most for phones, tablets and car head units, because they are reached over the air. Each CVE that applies to this class has its own heading below.

CVE-2026-74336: mac80211 out-of-bounds read in the S1G TIM parser

The S1G Partial Virtual Bitmap parser is given an end marker two bytes past the end of the TIM element payload. When the TIM is the last element in a received frame, the parser can read up to two bytes of adjacent socket buffer or heap data. This one matters more than a typical driver bug, because the code is part of the generic 802.11 stack rather than a vendor driver, so it applies to any device that uses CONFIG_MAC80211 with S1G support. The record marks it affected from 6.18 and names fixed versions only for 7.1.5 and mainline 7.2-rc1. It names no 6.18.x fix. We are not going to guess what that means. If you run 6.18 with S1G support, read the record and confirm with your vendor before you assume the branch update covers it. See the CVE record.

CVE-2026-74341: Qualcomm wcn36xx Wi-Fi heap overflow

The firmware response handler copies every synchronous HAL response into a 4096-byte buffer without checking the response length. A larger response overflows the heap with firmware-controlled content. Qualcomm wcn36xx parts appear in older phones and in some automotive and industrial modules, so check for CONFIG_WCN36XX. The flaw dates to 3.13. Fixed in 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5 and mainline 7.2-rc1. See the CVE record.

CVE-2026-74409: Realtek rtw89 missing bounds check on the firmware MAC id

The mac_id field in the receive descriptor is 8 bits wide, so it can hold values up to 255, but the array it indexes has only 128 entries. The value comes from firmware and was not checked before use. Realtek Wi-Fi 6 parts are common in tablets and in-vehicle infotainment modules, so check for CONFIG_RTW89. It affects 6.14 and later. Fixed in 6.18.40, 7.1.5 and mainline 7.2-rc1. See the CVE record.

CVE-2026-74302: Bluetooth core use-after-free on device teardown

Two delayed work items, cmd_timer and ncmd_timer, are not disabled before the HCI device structure is freed. If a command timeout fires while the device is being unregistered, the callback reads freed memory, including a function pointer. On a phone or head unit this is reached by removing or resetting the Bluetooth controller. It needs CONFIG_BT and affects 6.10 and later. Fixed in 6.12.97, 6.18.40, 7.1.5 and mainline 7.2-rc1. See the CVE record.

CVE-2026-74300: Bluetooth codec capability length not fully validated

The parser for codec capability elements checks the declared payload length against the bytes remaining in the buffer, but it does not account for the length byte itself. A malformed controller response can therefore make the parser record a capability that is one byte longer than the data actually present. It needs CONFIG_BT and affects 5.16 and later. Fixed in 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5 and mainline 7.2-rc1. See the CVE record.

Embedded and IoT

Two Wi-Fi drivers that are very common on single-board computers and routers are affected, along with the in-kernel SMB server and two protocols used in industrial and telecom stacks.

CVE-2026-74410: Realtek rtw88 out-of-bounds read on the PCIe receive path

The receive length is the sum of a 14-bit packet length field and a firmware-controlled offset, and that sum can exceed the size of the pre-allocated DMA buffer. The copy then reads past the end of the buffer. The USB transport already checked this; the PCIe transport did not. rtw88 parts are widely used on single-board computers and small routers. The gate is CONFIG_RTW88 together with CONFIG_RTW88_PCI, which is selected automatically by the per-chip PCIe options rather than chosen directly. It affects 5.2 and later and is fixed on every branch: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5 and mainline 7.2-rc1. See the CVE record.

CVE-2026-74408: Atheros ath9k out-of-bounds access from the transmit status queue id

The transmit status handler uses a 4-bit hardware field, which can hold values from 0 to 15, to index an array with only 10 entries. A value of 10 or above reads and writes outside the array. ath9k is one of the most widely deployed Wi-Fi drivers in embedded Linux, so this is worth checking on any device with CONFIG_ATH9K. It dates to 3.1 and is fixed on every branch, from 5.10.261 up to mainline 7.2-rc1. See the CVE record.

CVE-2026-72492: ksmbd use-after-free in the lease lookup

The in-kernel SMB server selects an existing lease from a list, then returns that pointer after dropping the lock without taking a reference on it. A concurrent close can free the lease before the caller reads it. This is reachable by any SMB client that can reach a ksmbd server, which makes it relevant for network-attached storage boxes, gateways and industrial file servers. The gate is CONFIG_SMB_SERVER. It affects 5.15 and later. Fixed in 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5 and mainline 7.2-rc1. Thirteen more ksmbd CVEs were published in the same batch, so if you ship ksmbd, apply the branch update rather than picking single patches. See the CVE record.

CVE-2026-74287: SCTP out-of-bounds read from an embedded address parameter

SCTP parameter validation confirms that the outer parameter is large enough to hold an embedded address header, but it does not confirm that the embedded parameter’s own declared length fits inside the outer parameter. A remote peer can declare a length that runs past the available bytes, and the address is then read out of bounds during INIT or ASCONF processing. SCTP is used in telecom signalling stacks and in some industrial and clinical equipment. The gate is CONFIG_IP_SCTP. The flaw dates to 2.6.12 and is fixed on every branch, from 5.10.261 up to mainline 7.2-rc1. See the CVE record.

CVE-2026-74255: TIPC use-after-free when a bearer is disabled

When a TIPC layer-2 bearer is disabled, the code waits for the RCU grace period while the device pointer is still published, so a reader can still pick it up after the wait. The pointer is cleared only later, without further synchronisation, which lets the network device be freed while a sender still holds it. TIPC is used for cluster communication in some industrial and telecom products. The gate is CONFIG_TIPC. It affects 4.4 and later and is fixed on every branch. See the CVE record.

CVE-2026-74283: TIPC netlink commands missing the admin permission check

The TIPCv2 generic netlink operations that change state were registered without the admin permission flag, and generic netlink only enforces CAP_NET_ADMIN when that flag is set. A local process with no capabilities could therefore change the network id and node identity, set and flush key material, and enable or disable a bearer. This is a local privilege problem, not a remote one, but on an appliance where an application runs unprivileged it matters. The gate is CONFIG_TIPC. It affects 3.19 and later and is fixed on every branch. See the CVE record.

Cloud and datacenter

The virtualization bugs are the highest priority here, followed by the BPF, RDMA and IPsec fixes that matter on shared or multi-tenant hosts.

CVE-2026-74312: vhost-vdpa virtqueue index not validated

The mmap and page-fault paths use the page offset supplied by the caller as a virtqueue index, and check only that it fits in 16 bits, not that it is below the number of queues the device actually has. An out-of-range index reaches driver-specific callbacks and can produce an invalid page mapping and a host crash. This is a guest-to-host surface on hosts that expose vDPA devices. The gate is CONFIG_VHOST_VDPA. It affects 5.8 and later and is fixed on every branch. See the CVE record.

CVE-2026-74310: vhost-net zerocopy buffer completed more than once

The zerocopy completion handler treats every callback as a finished descriptor, even when the callback only releases a cloned copy of the buffer. A backend reset can then free the reference structure while another cloned buffer still points at it, and a later completion reads freed memory. This runs on the host side of guest networking, so it is a guest-to-host concern. The gate is CONFIG_VHOST_NET. It affects 3.1 and later. Fixed in 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5 and mainline 7.2-rc1. See the CVE record.

CVE-2026-74404: AMD SEV-SNP off-by-one heap overflow in the CCP driver

The bounds check on the reserved memory region list allows exactly one entry too many. At 255 elements the check passes, but writing the 12 bytes for that entry runs past the end of the page-sized buffer. This is on the host path for AMD SEV-SNP confidential computing, so it matters for cloud providers offering confidential VMs on AMD hardware. The gate is CONFIG_CRYPTO_DEV_CCP. It affects 6.9 and later. Fixed in 6.12.97, 6.18.40, 7.1.5 and mainline 7.2-rc1. See the CVE record.

CVE-2026-74257: sockmap use-after-free in the UDP receive path

The shared message receive helper takes a message off the queue under a lock and then processes it without one, so each caller has to serialise access itself. The TCP and AF_UNIX paths do this. The UDP path had its lock removed by an earlier change. Two threads can then work on the same message and read freed memory. This matters where BPF sockmap is used for load balancing or service mesh data paths. The gate is CONFIG_BPF_SYSCALL. It affects 5.14 and later. Fixed in 6.18.40, 7.1.5 and mainline 7.2-rc1. See the CVE record.

CVE-2026-74371: BPF program query out-of-bounds write

The BPF_PROG_QUERY command always writes a revision field back to the caller’s buffer. A caller that passes the older, smaller attribute structure gets a write past the end of that buffer. Any process allowed to run BPF program queries can reach it, so it matters on hosts where containers hold BPF capabilities. The gate is CONFIG_BPF_SYSCALL. It affects 6.17 and later. Fixed in 6.18.40, 7.1.5 and mainline 7.2-rc1. See the CVE record.

CVE-2026-74378: RDMA soft-RoCE heap overflow from a re-read length field

The shared receive queue lives in memory mapped into userspace. The code reads the scatter-gather count from it, checks that count against the maximum, and then reads the same field again to work out how many bytes to copy. A second userspace thread can change the value between the check and the copy, which overflows the destination buffer. The gate is CONFIG_RDMA_RXE, the software RoCE driver. It affects 4.8 and later. Fixed in 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5 and mainline 7.2-rc1. See the CVE record.

CVE-2026-72463: IPsec device use-after-free, with fixes missing on 6.12 and 6.18

During asynchronous IPsec resumption the code holds a reference on the receiving network device, but a callback can replace that device with a tunnel device without taking a reference on the new one. Resumption then drops the wrong reference count, which frees the tunnel device while it is still in use. Read this record carefully. It marks four ranges as affected: 6.12.94 and later in the 6.12 series, 6.18.23 and later in the 6.18 series, 6.19.13 and later in the 6.19 series, and all of 7.0. It names fixed versions only for 7.1.5 and mainline 7.2-rc1. As the record stands today, none of 6.12.103, 6.18.44, the 6.19 series or the 7.0 series can be shown to clear it. The likely explanation is that the bug was introduced by a stable backport and the fix for those branches is still queued. If you run IPsec on 6.12 or 6.18, track this record and do not assume the branch update covers it. If you run IPsec on 6.19 or 7.0, note that both series are end of life, so the action is to move to 7.1.5 or newer. The gate is CONFIG_XFRM. See the CVE record.

CVE-2026-74290: traffic classifier exposes folded kernel pointers

The flow classifier falls back to folding a kernel pointer into a 32-bit value when a header field is missing from a packet. In map mode the caller controls the mask, shift, addend and divisor and can read the resulting class id back from statistics, which lets an unprivileged process in a user or network namespace recover the folded value of internal kernel pointers. The fix replaces the fold with a keyed hash. This matters on multi-tenant hosts because a leaked pointer helps defeat address randomisation. The gate is CONFIG_NET_CLS_FLOW. It affects 2.6.25 and later. Fixed in 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5 and mainline 7.2-rc1. See the CVE record.

CVE-2026-74270: handshake netlink DONE command missing its permission check

The kernel TLS handshake interface requires admin permission for the ACCEPT command but has no check at all on DONE. The lookup only confirms that a pending request exists for the given socket descriptor; it does not confirm who sent the message. An unprivileged process that guesses a valid descriptor can report a false success, so the kernel believes a handshake completed when it did not, or can report a failure and tear down a legitimate handshake in progress. The gate is CONFIG_NET_HANDSHAKE. It affects 6.4 and later. Fixed in 6.6.145, 6.12.97, 6.18.40, 7.1.5 and mainline 7.2-rc1. See the CVE record.

Medical devices

The wireless and network bugs above are the ones to review for connected clinical equipment. Four groups apply.

• Bluetooth. The fixes CVE-2026-74302 and CVE-2026-74300 matter for wearables, patient monitors and hearing devices that pair over Bluetooth.
• Wi-Fi. The fix CVE-2026-74336 is in the generic 802.11 stack. The fix CVE-2026-74410 is in the Realtek rtw88 driver. Both matter for infusion pumps, bedside monitors and imaging carts on hospital wireless networks.
• Network protocols. Clinical devices that carry DICOM, HL7 or FHIR over IP should review the SCTP fix CVE-2026-74287. SCTP carries signalling in some clinical and telecom stacks.
• File sharing. Any device that exposes an SMB share for image or report transfer should also apply CVE-2026-72492 in the in-kernel SMB server.

Patching a medical device is not the same as patching a server. The update has to pass validation and regulatory revalidation. The rules that apply are the US FDA postmarket cybersecurity guidance, the EU Medical Device Regulation (MDR) and IEC 62304. So the action is to plan the stable kernel update through the manufacturer’s change-control process. Do not apply it outside that process.

How to check which Linux kernel CVEs apply to you

There are three questions.

First, version. Run uname -r and compare the result with the table above. If your release is below the target for your branch, update to the target or newer. This clears every CVE in this week’s set for your branch, with two exceptions to read separately: CVE-2026-72463 on 6.12 and 6.18, and CVE-2026-74336 on 6.18.

Second, configuration. Check your kernel config for the feature behind each CVE. If the feature is not built, the matching CVE cannot affect you. On a running system with config access enabled, one command covers most of this week’s set.

raghu@techveda.org:~$ zcat /proc/config.gz | grep -E '^(# )?CONFIG_(MAC80211|BT|IP_SCTP|TIPC|SMB_SERVER)[ =]'
CONFIG_MAC80211=m
CONFIG_BT=m
CONFIG_IP_SCTP=m
# CONFIG_TIPC is not set
# CONFIG_SMB_SERVER is not set

The pattern is anchored on purpose. A plain grep CONFIG_BT would also match CONFIG_BTRFS_FS and every CONFIG_BT_* sub-option, which buries the answer.

In that output, the TIPC and ksmbd CVEs can be set aside, because the code is not built. If your system has no /proc/config.gz, use the config file from your build tree or the matching file under /boot. The other symbols worth checking are CONFIG_ATH9K, CONFIG_RTW88, CONFIG_RTW89, CONFIG_WCN36XX, CONFIG_VHOST_VDPA, CONFIG_VHOST_NET, CONFIG_BPF_SYSCALL, CONFIG_RDMA_RXE, CONFIG_XFRM, CONFIG_CRYPTO_DEV_CCP, CONFIG_NET_CLS_FLOW and CONFIG_NET_HANDSHAKE.

Third, reachability, which sets the order of work. Over-the-air and network-reachable bugs come first, because a remote party supplies the input: the Wi-Fi bugs CVE-2026-74336, CVE-2026-74341, CVE-2026-74410 and CVE-2026-74408, the Bluetooth bugs CVE-2026-74302 and CVE-2026-74300, the SCTP bug CVE-2026-74287, and the SMB server bug CVE-2026-72492. Local unprivileged bugs come next: CVE-2026-74257 and CVE-2026-74371 in BPF, CVE-2026-74378 in soft RoCE, CVE-2026-74283 and CVE-2026-74255 in TIPC, and the pointer leak CVE-2026-74290. Note that CVE-2026-74255 is triggered by disabling a bearer, which is an administrative action, so it is not a remote bug. Guest-to-host bugs come after that on shared virtualization hosts, led by CVE-2026-74312 and CVE-2026-74310. Bugs that need privilege or a specific configuration come last.

Key takeaways

• Update to the target release for your branch: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or mainline 7.2-rc1.
• The count is large because the kernel CNA published a backlog of older assignments in one batch, not because 1,086 new bugs were found this week.
• If you already applied last week’s targets, almost all of this batch needs no further work. The two exceptions below still apply.
• Schedule the over-the-air and network-reachable bugs first: CVE-2026-74336 (mac80211), CVE-2026-74341 (wcn36xx), CVE-2026-74410 (rtw88), CVE-2026-74408 (ath9k), CVE-2026-74302 and CVE-2026-74300 (Bluetooth), CVE-2026-74287 (SCTP) and CVE-2026-72492 (ksmbd).
• On virtualization hosts, apply the guest-to-host fixes CVE-2026-74312 and CVE-2026-74310, and CVE-2026-74404 if you run AMD SEV-SNP.
• Two records name no fix for the branch you may be on: CVE-2026-72463 on 6.12, 6.18, 6.19 and 7.0, and CVE-2026-74336 on 6.18. Read both records rather than assuming the branch update covers them.
• The 6.19 and 7.0 series are end of life. Move those systems to 7.1.5 or newer, which is also the only listed fix for CVE-2026-72463.
• 5.10 and 5.15 reach their projected end of life in December 2026. Plan the move now if you still ship them.
• None of these are 0-days; all fixes are already in stable. Use your kernel config to remove the CVEs that do not apply, and test the update on your own hardware.

Frequently asked questions

What is the one thing I should do?
Update to the target release for your branch: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or mainline 7.2-rc1. Then use your kernel config and device type to decide what to test first.

Why are there so many CVEs this week?
The kernel CNA published a large backlog of older assignments in one batch. The IDs sit mostly in three blocks, about 400 in 68xxx, about 490 in 72xxx and about 190 in 74xxx, with a few much older outliers. That distribution shows a catch-up publication rather than a sudden rise in newly discovered bugs.

Are any of these a 0-day?
No. All 1,086 CVEs are already fixed in stable, and there is no public exploit code. The action is to schedule the stable update through your normal process.

I already updated after last week’s advisory. Am I covered?
Almost. Last week’s targets were 5.10.264, 5.15.215, 6.1.182, 6.6.150, 6.12.102, 6.18.43 and 7.1.7, all of which are higher than this week’s targets, so nearly the whole batch needs no further action. Two records are exceptions, because they are not fixed on every branch: CVE-2026-72463 on 6.12, 6.18, 6.19 and 7.0, and CVE-2026-74336 on 6.18. Read both records for those branches.

Which ones should I schedule first?
The over-the-air and network-reachable bugs: the Wi-Fi fixes CVE-2026-74336, CVE-2026-74341, CVE-2026-74410 and CVE-2026-74408, the Bluetooth fixes CVE-2026-74302 and CVE-2026-74300, the SCTP fix CVE-2026-74287, and the SMB server fix CVE-2026-72492. None has public exploit code.

We do not build Wi-Fi, Bluetooth or the SMB server. Do these affect us?
Each bug is gated by a kernel config option. If CONFIG_MAC80211, CONFIG_BT, CONFIG_RTW88, CONFIG_ATH9K and CONFIG_SMB_SERVER are not built, those bugs cannot affect you. Check your config to remove the ones that do not apply.

I run IPsec. Is there anything special?
Yes. CVE-2026-72463 marks four ranges as affected: 6.12.94 and later, 6.18.23 and later, 6.19.13 and later, and all of 7.0. Its record names fixed versions only for 7.1.5 and mainline 7.2-rc1. As published, the branch update cannot be shown to clear it on 6.12, 6.18, 6.19 or 7.0. Track the record and treat it separately from the rest of the batch. The 6.19 and 7.0 series are end of life, so for those the action is to move to 7.1.5 or newer.

Further reading

• linux-cve-announce, 9 to 15 August 2026
• CVE-2026-74336 (mac80211 S1G TIM) and CVE-2026-74341 (wcn36xx Wi-Fi)
• CVE-2026-74302 (Bluetooth core) and CVE-2026-74287 (SCTP)
• CVE-2026-72492 (ksmbd) and CVE-2026-74312 (vhost-vdpa)
• CVE-2026-72463 (IPsec, fix pending on 6.12 and 6.18)
• kernel.org active releases and projected end-of-life dates
• Previous edition: Linux Kernel CVEs, 2 to 8 August 2026