EUVD-2026-59485

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject sleepable BPFLSMCGROUP programs at load time The cgroup shim runs under rcureadlockdontmigrate, so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts to lo...

CVE-2026-74337 bpf: Fix NMI/tracepoint re-entry deadlock on lru locks

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks NMI and tracepoint BPF programs can re-enter the per-CPU or global LRU lock that bpflrupopfree/pushfree already hold on the same CPU, AA-deadlocking. Lockdep reports...

EUVD-2026-59484

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks NMI and tracepoint BPF programs can re-enter the per-CPU or global LRU lock that bpflrupopfree/pushfree already hold on the same CPU, AA-deadlocking. Lockdep reports...

CVE-2026-74335 bpf: Fix NULL pointer dereference in bpf_task_from_vpid()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpftaskfromvpid bpftaskfromvpid looks up a task in the pid namespace of the current task, via findtaskbyvpid: findtaskbyvpidvpid findtaskbypidnsvpid, taskactivepidnscurrent findpidnsnr, ns -...

EUVD-2026-59483

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bound S1G TIM PVB walk to the TIM element ieee80211s1gchecktim parses the S1G Partial Virtual Bitmap PVB of a received TIM element. The TIM is handed in as the element payload: ieee80211parseelemsfull stores...

EUVD-2026-59482

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpftaskfromvpid bpftaskfromvpid looks up a task in the pid namespace of the current task, via findtaskbyvpid: findtaskbyvpidvpid findtaskbypidnsvpid, taskactivepidnscurrent findpidnsnr, ns -...

EUVD-2026-59481

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Fix locking when accessing mr-pd Sashiko points out that, due to reregmr, the PD is actually variable and all the touches in nldev are racy. Use mr-device instead of mr-pd-device. Getting the PD restrack ID is more...

CVE-2026-74334 RDMA/nldev: Fix locking when accessing mr->pd

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Fix locking when accessing mr-pd Sashiko points out that, due to reregmr, the PD is actually variable and all the touches in nldev are racy. Use mr-device instead of mr-pd-device. Getting the PD restrack ID is more...

EUVD-2026-59480

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-legacy: Bound DAI link iteration createsdwdailinks walks socdais until it finds an entry with initialised cleared, but socdais is allocated with exactly numends entries. If all entries are initialised, the loop...

CVE-2026-74333 ASoC: amd: acp-sdw-legacy: Bound DAI link iteration

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-legacy: Bound DAI link iteration createsdwdailinks walks socdais until it finds an entry with initialised cleared, but socdais is allocated with exactly numends entries. If all entries are initialised, the loop...

EUVD-2026-59479

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-sof: Bound DAI link iteration createsdwdailinks walks sofdais until it finds an entry with initialised cleared, but sofdais is allocated with exactly numends entries. If all entries are initialised, the loop...

CVE-2026-74332 ASoC: amd: acp-sdw-sof: Bound DAI link iteration

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-sof: Bound DAI link iteration createsdwdailinks walks sofdais until it finds an entry with initialised cleared, but sofdais is allocated with exactly numends entries. If all entries are initialised, the loop...

EUVD-2026-59478

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: Fix recursive lock in devicecachefwimages A recursive locking deadlock can occur in the firmware loader's power management notification handler. During system suspend or hibernation preparation, fwpmnotify calls...

CVE-2026-74330 configfs: fix lockless traversals of ->s_children

In the Linux kernel, the following vulnerability has been resolved: configfs: fix lockless traversals of -schildren Having the parent directory locked protects entries from removal by another thread, but it does not protect cursors from being moved around by lseek - or freed, for that matter...

EUVD-2026-59477

In the Linux kernel, the following vulnerability has been resolved: configfs: fix lockless traversals of -schildren Having the parent directory locked protects entries from removal by another thread, but it does not protect cursors from being moved around by lseek - or freed, for that matter...

CVE-2026-74329 watchdog: unregister PM notifier on watchdog unregister

In the Linux kernel, the following vulnerability has been resolved: watchdog: unregister PM notifier on watchdog unregister watchdogregisterdevice registers wdd-pmnb when WDOGNOPINGONSUSPEND is set, but watchdogunregisterdevice does not remove it. This leaves an embedded notifier block on the PM...

EUVD-2026-59476

In the Linux kernel, the following vulnerability has been resolved: watchdog: unregister PM notifier on watchdog unregister watchdogregisterdevice registers wdd-pmnb when WDOGNOPINGONSUSPEND is set, but watchdogunregisterdevice does not remove it. This leaves an embedded notifier block on the PM...

CVE-2026-74328 iommufd: Destroy the pages content after detaching from dmabuf

In the Linux kernel, the following vulnerability has been resolved: iommufd: Destroy the pages content after detaching from dmabuf Sashiko points out this has gotten out of order, the mutex could still be in use through the dmabuf invalidation callbacks. Don't destroy any of the pages content unt...

EUVD-2026-59475

In the Linux kernel, the following vulnerability has been resolved: iommufd: Destroy the pages content after detaching from dmabuf Sashiko points out this has gotten out of order, the mutex could still be in use through the dmabuf invalidation callbacks. Don't destroy any of the pages content unt...

CVE-2026-74327 vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()

In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix NULL pointer dereference in isvmareahugepages findvmarea can return NULL if the given address is not a valid vmalloc area. Check the return value before dereferencing it to avoid a kernel crash...