The Linux kernel team disclosed a fresh batch of CVEs on July 19-20, 2026, exposing systems to deadlocks, livelocks, and NULL pointer dereference crashes across subsystems including filesystems, Bluetooth, networking, and memory management.
These flaws were patched upstream and disclosed via the linux-cve-announce mailing list, with fixes already merged into stable kernel branches.
New Linux Kernel Vulnerabilities
CVE-2026-64187 affects the XFS filesystem, where the log recovery path failed to properly reject a committed log item containing no regions, a defect that can corrupt recovery logic and destabilize journaling during crash recovery.
This flaw sits alongside a related class of XFS issues previously identified in the Active Item List (AIL) push callbacks, where dropping locks during buffer I/O let background reclaim free log items prematurely, producing use-after-free conditions.
Separately, CVE-2026-64074 in fs/statmount introduces a slab out-of-bounds write in statmount_mnt_idmap, another filesystem-adjacent memory-safety bug patched in the same update wave.
CVE-2026-64206 is the standout deadlock vulnerability: the L2CAP teardown function l2cap_conn_del() acquires conn->lock and then calls cancel_work_sync() to flush pending_rx_work, but process_pending_rx() takes the same mutex, meaning the teardown thread can block indefinitely against the very worker it is trying to cancel.
The fix reorders the sequence to cancel the pending work before taking the lock, eliminating the circular wait condition.
This is the latest in a string of L2CAP locking defects this year, following similar lock-ordering inversions such as CVE-2026-53358, where cleanup_listen() risked violating the established conn->lock, chan->lock, sk_lock hierarchy.
CVE-2026-64207 fixes GSO backlog accounting in the net/sched dualpi2 queuing discipline, a bug class that typically manifests as livelocks or incorrect queue-length bookkeeping under sustained segmentation-offload traffic.
CVE-2026-64190 addresses a NULL pointer dereference in team_xmit() that can be triggered during a network team’s mode change, while CVE-2026-64188 fixes a use-after-free of endpoint structures in the Qualcomm rmnet driver‘s dellink() teardown path.
CVE-2026-64189 resolves a race condition between netfilter ipset dump operations and list resizing, and CVE-2026-64120 patches a separate NULL pointer dereference in ethtool’s phy_reply_size() handler.
Several lower-severity but still notable fixes target device drivers and kernel infrastructure. CVE-2026-64192 rejects BPF_MAP_TYPE_INODE_STORAGE creation when the BPF LSM hasn’t initialized, closing a state-confusion path.
According to Lore, the flaw CVE-2026-64205 corrects hardware state-machine corruption in the i2c-i801 driver’s error-handling path, and CVE-2026-64191 rejects malformed I2C block transfers with invalid length in the i2c-stub driver.
Highest-impact fixes
| CVE | Component | Primary Impact |
|---|---|---|
| CVE-2026-64187 | XFS log recovery | Recovery corruption on malformed log items |
| CVE-2026-64206 | Bluetooth L2CAP | Deadlock during connection teardown |
| CVE-2026-64207 | net/sched dualpi2 | GSO backlog miscount, potential livelock |
| CVE-2026-64190 | net/team | NULL pointer dereference on mode change |
| CVE-2026-64188 | Qualcomm rmnet | Use-after-free in dellink() |
| CVE-2026-64189 | netfilter ipset | Race between dump and resize |
| CVE-2026-64192 | BPF LSM | Rejects uninitialized map creation |
None of these flaws currently carry public exploit code, but their local, low-complexity nature (several rated CVSS “Low” for confidentiality/integrity impact) makes them prime candidates for local privilege-escalation chaining in multi-tenant or containerized Linux environments.
Administrators running mainline or LTS kernels are advised to track the upstream stable patches referenced in each advisory and prioritize the Bluetooth and XFS fixes given their proximity to network-facing and storage-critical code paths.
Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs
