200+ Linux Kernel CVEs Disclosed in 48 Hours: XFS, Bluetooth, ksmbd Flaws Fixed

The Linux kernel security team pushed out more than 200 CVE identifiers between July 19 and 20, 2026, through the linux-cve-announce mailing list, covering everything from filesystem recovery flaws to Bluetooth stack race conditions.

The disclosure batch, tracked via Greg Kroah-Hartman’s automated CVE pipeline, spans CVE-2026-64005 through CVE-2026-64207, reflecting the kernel project’s now-routine practice of assigning CVEs to nearly every bug fix merged into stable trees.

200+ Linux Kernel CVEs Disclosed in 48 Hours

The sheer volume, over 200 entries in roughly 48 hours, underscores a trend security researchers have flagged before: the Linux CVE numbering authority treats almost any patched bug as a security issue, regardless of exploitability.

The most recent entry, CVE-2026-64187, addresses a flaw in the XFS filesystem where log recovery failed to properly handle a committed log item containing no regions, a defect that could destabilize filesystem recovery after a crash.

This mirrors a broader pattern this cycle, with CVE-2026-64164 fixing a “sleep while in atomic context” bug in Btrfs tracepoints during file sync operations, both pointing to ongoing fragility in kernel storage-layer recovery paths.

Several high-severity fixes target concurrency bugs in networking subsystems. CVE-2026-64206 resolves a race condition in the Bluetooth L2CAP layer where pending_rx_work wasn’t canceled before acquiring conn->lock, a classic use-after-free precursor.

CVE-2026-64178 fixes a use-after-free read of dev->name in the Bluetooth BNEP driver, while CVE-2026-64109 addresses a UAF read of tail->len in af_unix’s unix_stream_data_wait(). The netfilter subsystem also saw multiple race-condition fixes, including CVE-2026-64189 for a dump-versus-resize race in ipset.

“What stands out in this batch isn’t any single critical remote-code-execution bug; it’s the sheer density of use-after-free and race-condition patches clustered in Bluetooth, netfilter, and the netfs layer.

That concentration suggests these subsystems are undergoing active fuzzing or stress-testing upstream, and defenders running kernels with Bluetooth or SMB/CIFS exposure should treat this wave as a priority patch cycle rather than routine maintenance.”

A notable cluster of fixes, roughly a dozen CVEs including CVE-2026-64058 through CVE-2026-64069, targets the netfs (network filesystem helper) layer, addressing deadlocks, folio leaks, and streaming-write corruption bugs that affect AFS and Ceph-based mounts.

Separately, ksmbd, the in-kernel SMB3 server, picked up six fixes (CVE-2026-64137 through CVE-2026-64142) covering null-pointer dereferences, SID memory leaks, and ACL inheritance validation gaps that could be triggered by malicious SMB clients.

Driver-level vulnerabilities dominate the tail end of the list, spanning i2c controllers (CVE-2026-64191, CVE-2026-64205), SPI DMA setup paths across three separate drivers (CVE-2026-64168–64170), and GPU components including drm/msm and drm/amd/display.

The pmbus/adm1266 hardware monitoring driver alone received seven distinct patches (CVE-2026-64083 through CVE-2026-64087) for buffer overflow and out-of-bounds read conditions in its blackbox diagnostic interface.

None of the disclosed issues currently show evidence of active exploitation, but the concentration of use-after-free and memory-corruption classes warrants prioritized patch review, particularly for systems exposing Bluetooth, SMB shares, or network filesystems to untrusted input.

Organizations tracking kernel CVEs at this volume should focus triage on subsystems they actually expose rather than attempting to patch every entry with equal urgency.