EUVD-2026-59480

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-legacy: Bound DAI link iteration createsdwdailinks walks socdais until it finds an entry with initialised cleared, but socdais is allocated with exactly numends entries. If all entries are initialised, the loop...

CVE-2026-74333 ASoC: amd: acp-sdw-legacy: Bound DAI link iteration

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-legacy: Bound DAI link iteration createsdwdailinks walks socdais until it finds an entry with initialised cleared, but socdais is allocated with exactly numends entries. If all entries are initialised, the loop...

EUVD-2026-59479

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-sof: Bound DAI link iteration createsdwdailinks walks sofdais until it finds an entry with initialised cleared, but sofdais is allocated with exactly numends entries. If all entries are initialised, the loop...

CVE-2026-74332 ASoC: amd: acp-sdw-sof: Bound DAI link iteration

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-sof: Bound DAI link iteration createsdwdailinks walks sofdais until it finds an entry with initialised cleared, but sofdais is allocated with exactly numends entries. If all entries are initialised, the loop...

EUVD-2026-59478

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: Fix recursive lock in devicecachefwimages A recursive locking deadlock can occur in the firmware loader's power management notification handler. During system suspend or hibernation preparation, fwpmnotify calls...

CVE-2026-74330 configfs: fix lockless traversals of ->s_children

In the Linux kernel, the following vulnerability has been resolved: configfs: fix lockless traversals of -schildren Having the parent directory locked protects entries from removal by another thread, but it does not protect cursors from being moved around by lseek - or freed, for that matter...

EUVD-2026-59477

In the Linux kernel, the following vulnerability has been resolved: configfs: fix lockless traversals of -schildren Having the parent directory locked protects entries from removal by another thread, but it does not protect cursors from being moved around by lseek - or freed, for that matter...

CVE-2026-74329 watchdog: unregister PM notifier on watchdog unregister

In the Linux kernel, the following vulnerability has been resolved: watchdog: unregister PM notifier on watchdog unregister watchdogregisterdevice registers wdd-pmnb when WDOGNOPINGONSUSPEND is set, but watchdogunregisterdevice does not remove it. This leaves an embedded notifier block on the PM...

EUVD-2026-59476

In the Linux kernel, the following vulnerability has been resolved: watchdog: unregister PM notifier on watchdog unregister watchdogregisterdevice registers wdd-pmnb when WDOGNOPINGONSUSPEND is set, but watchdogunregisterdevice does not remove it. This leaves an embedded notifier block on the PM...

CVE-2026-74328 iommufd: Destroy the pages content after detaching from dmabuf

In the Linux kernel, the following vulnerability has been resolved: iommufd: Destroy the pages content after detaching from dmabuf Sashiko points out this has gotten out of order, the mutex could still be in use through the dmabuf invalidation callbacks. Don't destroy any of the pages content unt...

EUVD-2026-59475

In the Linux kernel, the following vulnerability has been resolved: iommufd: Destroy the pages content after detaching from dmabuf Sashiko points out this has gotten out of order, the mutex could still be in use through the dmabuf invalidation callbacks. Don't destroy any of the pages content unt...

CVE-2026-74327 vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()

In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix NULL pointer dereference in isvmareahugepages findvmarea can return NULL if the given address is not a valid vmalloc area. Check the return value before dereferencing it to avoid a kernel crash...

EUVD-2026-59474

In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix NULL pointer dereference in isvmareahugepages findvmarea can return NULL if the given address is not a valid vmalloc area. Check the return value before dereferencing it to avoid a kernel crash...

EUVD-2026-59473

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix resource leak in probe error path When pcimiomapregion or devmkmemdup fail, the code returns directly without cleaning up previously allocated resources: - mt76device allocated by mt76allocdevice - pci irq...

CVE-2026-74325 wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: use kfreercu for offchannel link in mt76putvifphylink mt76putvifphylink frees the offchannel mlink with plain kfree after rcuassignpointerNULL. However, rcuassignpointer only prevents future RCU readers from obtaining...

CVE-2026-74326 wifi: mt76: mt7921: fix resource leak in probe error path

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix resource leak in probe error path When pcimiomapregion or devmkmemdup fail, the code returns directly without cleaning up previously allocated resources: - mt76device allocated by mt76allocdevice - pci irq...

EUVD-2026-59472

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: use kfreercu for offchannel link in mt76putvifphylink mt76putvifphylink frees the offchannel mlink with plain kfree after rcuassignpointerNULL. However, rcuassignpointer only prevents future RCU readers from obtaining...

CVE-2026-74324 wifi: mt76: mt7925: validate skb length in testmode query

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: validate skb length in testmode query In mt7925tmquery, the response skb from mt76mcusendandgetmsg is used in a memcpy without validating its length: memcpyevtresp, skb-data + 8, MT7925EVTRSPLEN; where...

EUVD-2026-59470

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible token leak in mt7996txprepareskb If linkconf or linksta lookup fails in mt7996txprepareskb routine, mt7996 driver leaks an already allocated tx token. Fix the issue releasing the token in case of...

CVE-2026-74323 wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible token leak in mt7996txprepareskb If linkconf or linksta lookup fails in mt7996txprepareskb routine, mt7996 driver leaks an already allocated tx token. Fix the issue releasing the token in case of...