EUVD-2026-59514

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix inconsistent arvif state in vdevcreate error paths ath12kmacvdevcreate has three error path issues that leave arvif in an inconsistent state: 1. When ath12kwmivdevcreate fails, the function returns directly...

CVE-2026-74367 wifi: ath12k: fix inconsistent arvif state in vdev_create error paths

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix inconsistent arvif state in vdevcreate error paths ath12kmacvdevcreate has three error path issues that leave arvif in an inconsistent state: 1. When ath12kwmivdevcreate fails, the function returns directly...

EUVD-2026-59513

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in changestalinks for unready link ieee80211setactivelinks calls ieee80211linkusechannel for each newly-added link and WARNONONCEs if it fails. The call uses assignonfailure=true, which allows mac8021...

CVE-2026-74366

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in changestalinks for unready link ieee80211setactivelinks calls ieee80211linkusechannel for each newly-added link and WARNONONCEs if it fails. The call uses assignonfailure=true, which allows mac8021...

CVE-2026-74367

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix inconsistent arvif state in vdevcreate error paths ath12kmacvdevcreate has three error path issues that leave arvif in an inconsistent state: 1. When ath12kwmivdevcreate fails, the function returns directly...

CVE-2026-74367

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix inconsistent arvif state in vdevcreate error paths ath12kmacvdevcreate has three error path issues that leave arvif in an inconsistent state: 1. When ath12kwmivdevcreate fails, the function returns directly...

CVE-2026-74366

CVE-2026-74366 concerns a NULL dereference in the Linux kernel’s ath12k wifi driver when handling unready links. The issue occurs because a path that validates a MAC channel may not create the vdev, leaving arvif->is_created as false and arvif->ar NULL. Subsequent code paths allocate an ars...

CVE-2026-74366 wifi: ath12k: fix NULL deref in change_sta_links for unready link

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in changestalinks for unready link ieee80211setactivelinks calls ieee80211linkusechannel for each newly-added link and WARNONONCEs if it fails. The call uses assignonfailure=true, which allows mac8021...

CVE-2026-74365 nvdimm/btt: Handle preemption in BTT lane acquisition

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

CVE-2026-74365

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

EUVD-2026-59512

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

CVE-2026-74365

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

CVE-2026-74365 nvdimm/btt: Handle preemption in BTT lane acquisition

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

EUVD-2026-59511

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps as inner maps in map-in-map An exclusive map created with exclproghash is bound to a single program by hash: checkmapprogcompatibility refuses to load any program whose digest does not match...

CVE-2026-74364 bpf: Reject exclusive maps as inner maps in map-in-map

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps as inner maps in map-in-map An exclusive map created with exclproghash is bound to a single program by hash: checkmapprogcompatibility refuses to load any program whose digest does not match...

CVE-2026-74363

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 "bpf: Avoid RCU context warning when unpinning htab with internal structs" moved inode cleanup from -freeinode into -destroyinode to avoid sleeping ...

CVE-2026-74364

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps as inner maps in map-in-map An exclusive map created with exclproghash is bound to a single program by hash: checkmapprogcompatibility refuses to load any program whose digest does not match...

CVE-2026-74363 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 "bpf: Avoid RCU context warning when unpinning htab with internal structs" moved inode cleanup from -freeinode into -destroyinode to avoid sleeping ...

CVE-2026-74364 bpf: Reject exclusive maps as inner maps in map-in-map

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps as inner maps in map-in-map An exclusive map created with exclproghash is bound to a single program by hash: checkmapprogcompatibility refuses to load any program whose digest does not match...

EUVD-2026-59510

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 "bpf: Avoid RCU context warning when unpinning htab with internal structs" moved inode cleanup from -freeinode into -destroyinode to avoid sleeping ...