CVE-2026-74478 um: vector: fix use-after-free in vector_mmsg_rx()

In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vectormmsgrx When vectormmsgrx discards a packet whose overlay header fails verifyheader, it frees the skb and continues the loop: if headercheck estats.rxencapserrors++; continue; The normal and...

CVE-2026-74477 uprobes: Fix NULL pointer dereference in hprobe_expire()

In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobeexpire Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clone path: BUG: kernel NULL pointer dereference, address:...

CVE-2026-74477 uprobes: Fix NULL pointer dereference in hprobe_expire()

In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobeexpire Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clone path: BUG: kernel NULL pointer dereference, address:...

CVE-2026-74477

CVE-2026-74477 affects the Linux kernel uprobe handling, specifically a NULL pointer dereference in hprobe_expire() during forking a task with a pending uretprobe. The issue can occur in the clone path, with a NULL uprobe check leading to an OOPS in the hprobe_expire flow (uprobe_copy_process → c...

EUVD-2026-59670

In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobeexpire Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clone path: BUG: kernel NULL pointer dereference, address:...

EUVD-2026-59669

In the Linux kernel, the following vulnerability has been resolved: veth: convert fraglist skbs before running XDP A fraglist skb can reach veth with datalen set but nrfrags zero. vethconvertskbtoxdpbuff only converts skbs that are shared, locked, have frags, or do not have enough headroom. It...

CVE-2026-74476 veth: convert frag_list skbs before running XDP

In the Linux kernel, the following vulnerability has been resolved: veth: convert fraglist skbs before running XDP A fraglist skb can reach veth with datalen set but nrfrags zero. vethconvertskbtoxdpbuff only converts skbs that are shared, locked, have frags, or do not have enough headroom. It...

CVE-2026-74476

The CVE-2026-74476 entry describes a Linux kernel vulnerability in the veth path where a frag_list skb can reach veth with data_len set but nr_frags zero. The root cause is that veth_convert_skb_to_xdp_buff() could expose frag_list data to XDP as if it were in frags[], even though frags[] is empt...

CVE-2026-74476 veth: convert frag_list skbs before running XDP

In the Linux kernel, the following vulnerability has been resolved: veth: convert fraglist skbs before running XDP A fraglist skb can reach veth with datalen set but nrfrags zero. vethconvertskbtoxdpbuff only converts skbs that are shared, locked, have frags, or do not have enough headroom. It...

CVE-2026-74474

CVE-2026-74474 pertains to the Linux kernel where the transmit path in VXLAN code (vxlan_xmit, arp_reduce, vxlan_mdb_entry_skb_get) used pskb_may_pull() to verify network-layer header availability. Because skb->data points to the MAC header (offset ~ ETH_HLEN), pskb_may_pull() could fail to ac...

CVE-2026-74475 vxlan: use neigh_ha_snapshot() in route_shortcircuit()

In the Linux kernel, the following vulnerability has been resolved: vxlan: use neighhasnapshot in routeshortcircuit The neighbour hardware address n-ha can be updated asynchronously by the neighbour subsystem, protected by n-halock seqlock. Reading n-ha without holding the seqlock loop can lead t...

EUVD-2026-59668

In the Linux kernel, the following vulnerability has been resolved: vxlan: use neighhasnapshot in routeshortcircuit The neighbour hardware address n-ha can be updated asynchronously by the neighbour subsystem, protected by n-halock seqlock. Reading n-ha without holding the seqlock loop can lead t...

CVE-2026-74474 vxlan: use pskb_network_may_pull() for transmit path header pulls

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull for transmit path header pulls In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the availability of network layer headers ARP, IPv6/ND, IP/IPv6 MDB keys...

CVE-2026-74474 vxlan: use pskb_network_may_pull() for transmit path header pulls

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull for transmit path header pulls In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the availability of network layer headers ARP, IPv6/ND, IP/IPv6 MDB keys...

EUVD-2026-59667

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull for transmit path header pulls In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the availability of network layer headers ARP, IPv6/ND, IP/IPv6 MDB keys...

CVE-2026-74473 vxlan: use pskb_network_may_pull() in route_shortcircuit()

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull in routeshortcircuit routeshortcircuit currently calls pskbmaypullskb, sizeofstruct iphdr or ipv6hdr, which checks if bytes are available starting from skb-data. However, in vxlanxmit, skb-data point...

CVE-2026-74473 vxlan: use pskb_network_may_pull() in route_shortcircuit()

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull in routeshortcircuit routeshortcircuit currently calls pskbmaypullskb, sizeofstruct iphdr or ipv6hdr, which checks if bytes are available starting from skb-data. However, in vxlanxmit, skb-data point...

EUVD-2026-59666

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull in routeshortcircuit routeshortcircuit currently calls pskbmaypullskb, sizeofstruct iphdr or ipv6hdr, which checks if bytes are available starting from skb-data. However, in vxlanxmit, skb-data point...

CVE-2026-74473

CVE-2026-74473 affects the Linux kernel’s VXLAN path. The issue arises in route_shortcircuit() which originally used pskb_may_pull() to ensure a network header length, but skb->data points to the MAC header in vxlan_xmit(), making the check insufficient and risking reading beyond the pulled bu...

CVE-2026-74471 tracing: Check return value of __register_event() in trace_module_add_events()

In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of registerevent in tracemoduleaddevents tracemoduleaddevents ignores the return value of registerevent and unconditionally calls addeventtotracers for each event. If registerevent fails for example, i...