CVE-2026-74596

In the Linux kernel, the following vulnerability has been resolved: fs,fsverity: remove check for fsverity being enabled in setattrprepare The check that fs-verity is available in the kernel is not necessary here. Filesystems could have fsverity files even without fs-verity enabled. In that case,...

CVE-2026-74590

In the Linux kernel, the following vulnerability has been resolved: fsverity: Fix bpfgetfsveritydigest dynptr assumptions The BPF verifier and the dynptr abstraction ensure that the memory space referenced by a dynptr remains valid. They do not, however, provide any guarantee that the contents of...

CVE-2026-74591

In the Linux kernel, the following vulnerability has been resolved: mm/filemap: filemapaddfolio restore index before retrying In filemapaddfolio's split-a-conflict loop, xassetorder is applied repeatedly: each application modifies xas.xaindex, rounding it down according to the splitorder attempte...

CVE-2026-74589

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...

CVE-2026-74587

In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addiplastasconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctpasconfqueueteardown...

CVE-2026-74585

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound the DROM dual link port number before indexing sw-ports tbdromparseentryport validates the device-supplied header-index against sw-config.maxportnumber before indexing sw-ports, but the sibling field...

CVE-2026-74586

In the Linux kernel, the following vulnerability has been resolved: sctp: clear newtransport when removing a peer sctpprocessasconfparam stores a newly added peer transport in asoc-newtransport. After all parameters in the ASCONF chunk have been processed, sctpsfdoasconf uses this pointer to send...

CVE-2026-74588

In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk-transport in step with the list it is queued on sctpoutqflushrtx moves a gap-acked chunk onto another transport's transmitted list without updating chunk-transport: if chunk-tsngapacked...

CVE-2026-74733 gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

CVE-2026-74733

A race condition in the Linux kernel's gpio: pca953x driver (managing PCA953x GPIO expanders) allows concurrent threads to access hardware registers without proper locking. The function pca953x_irq_bus_sync_unlock() performed regmap read/write operations without holding the driver's i2c_lock , wh...

CVE-2026-74733

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

CVE-2026-74733 gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

EUVD-2026-64420

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

CVE-2026-74731 sched_ext: Skip sub-disable teardown for never-linked sub-schedulers

In the Linux kernel, the following vulnerability has been resolved: schedext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scxlinksched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs th...

EUVD-2026-64418

In the Linux kernel, the following vulnerability has been resolved: schedext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scxlinksched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs th...

CVE-2026-74732

CVE-2026-74732 is a NULL pointer dereference in the Linux kernel's drm/amd/display driver, specifically in the dce110_set_avmute function. Some older DCE timing generators do not implement is_tg_enabled in their ops table. Calling this function unconditionally when waiting for AV mute frames trig...

CVE-2026-74731

CVE-2026-74731 is a use-after-free vulnerability in the Linux kernel's sched_ext (extensible scheduler) component. When a sub-scheduler enable fails before scx_link_sched() links it into the hierarchy, the cleanup path still runs the full scx_sub_disable(). This creates a race against root disabl...

CVE-2026-74731

In the Linux kernel, the following vulnerability has been resolved: schedext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scxlinksched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs th...

CVE-2026-74732

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check for tg ops in dce110setavmute Some older DCE timing generators do not implement istgenabled in their ops table. Calling it unconditionally when waiting for AV mute frames causes a NULL pointer dereference o...

CVE-2026-74732 drm/amd/display: Check for tg ops in dce110_set_avmute

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check for tg ops in dce110setavmute Some older DCE timing generators do not implement istgenabled in their ops table. Calling it unconditionally when waiting for AV mute frames causes a NULL pointer dereference o...