CVE-2026-41848

CVE-2026-41848...

CVE-2026-41849

CVE-2026-41849...

CVE-2026-12999

CVE-2026-12999 affects the Infineon Airoc Wi-Fi driver in Zephyr RTOS (drivers/wifi/infineon/airoc_wifi.c). The transmit callback airoc_mgmt_send() leaks a net_buf from the fixed airoc_pool (default 20 buffers) whenever whd_network_send_ethernet_data() returns a synchronous failure, because the b...

EUVD-2026-64597

The Infineon Airoc Wi-Fi driver's transmit callback airocmgmtsend in drivers/wifi/infineon/airocwifi.c allocates a netbuf from the fixed airocpool for every outbound packet. When whdnetworksendethernetdata returns a synchronous failure, the underlying WHD library does not take ownership of the...

CVE-2026-59317

CVE-2026-59317...

CVE-2026-74703

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Validate T10 PI scatterlist counts When T10 PI is negotiated, vhost-scsi splits protection bytes from the data iterator before mapping the request scatterlists. A malformed request can claim protection bytes that cove...

CVE-2026-74684

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

CVE-2026-74663

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject overly deep qdisc hierarchies Deep qdisc hierarchies can lead to excessive recursion in qdisc tree walkers and exhaust the kernel stack. The existing loop check does not cover the create-and-graft path, so a...

CVE-2026-74658

In the Linux kernel, the following vulnerability has been resolved: futex: Prevent robust futex exit race some more A robust futex unlock stores 0 over the whole futex value - wiping FUTEXWAITERS - and wakes a single waiter. That wakeup is a one-shot notification: the protocol relies on its...

CVE-2026-74626

In the Linux kernel, the following vulnerability has been resolved: NTB: ntbnetdev: Preserve RX queue depth on allocation failure ntbnetdevrxhandler hands the received skb to the network stack before allocating its replacement. If the allocation fails, nothing is reposted. Every failure therefore...

CVE-2026-74619

In the Linux kernel, the following vulnerability has been resolved: ovl: don't warn when the mount is completed from another user namespace fsopen records the caller's user namespace in fc-userns and hands back an ordinary file descriptor. Nothing ties the task that calls fsconfigFSCONFIGCMDCREAT...

CVE-2026-74600

In the Linux kernel, the following vulnerability has been resolved: mm/pagetablecheck: skip special zero mappings pagetablecheckset and pagetablecheckclear account mappings based on PageAnon. Shared zero-page PTEs and huge zero PMDs are special mappings, but pagetablecheck can still account them ...

CVE-2026-74590

In the Linux kernel, the following vulnerability has been resolved: fsverity: Fix bpfgetfsveritydigest dynptr assumptions The BPF verifier and the dynptr abstraction ensure that the memory space referenced by a dynptr remains valid. They do not, however, provide any guarantee that the contents of...

EUVD-2026-64415

In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL baddr in xfsbuffree When xfsbufallocbackingmem fails, xfsbuffree is called with bp-baddr still NULL. The code falls through to the folioput path which calls virttofolioNULL, dereferencing an invalid address and...

CVE-2026-74713

CVE-2026-74713 affects the Linux kernel vhost_iotlb subsystem. The root cause is that vhost_iotlb_add_range_ctx() only retires an old entry when the table has a non-zero limit, has exactly reached that limit, and has VHOST_IOTLB_FLAG_RETIRE set. Non-retiring tables can keep allocating entries aft...

CVE-2026-74704 net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcake: drop WARNON1 for malformed packets in ACK filter The schcake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARNON1 which can...

CVE-2026-74702 vhost-scsi: reject feature changes after endpoint

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhostscsisetupvqcmds runs from VHOSTSCSISETENDPOINT and allocates each command's protection scatterlist array protsgl according to the acknowledged VIRTIOSCSIFT10PI bit. The comma...

CVE-2026-74703 vhost-scsi: Validate T10 PI scatterlist counts

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Validate T10 PI scatterlist counts When T10 PI is negotiated, vhost-scsi splits protection bytes from the data iterator before mapping the request scatterlists. A malformed request can claim protection bytes that cove...

EUVD-2026-64371

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

CVE-2026-74664

This vulnerability affects the Linux kernel's Open vSwitch (OVS) netlink flow command handling. The root cause is in ovs_flow_cmd_new(), which preallocates the reply skb sized from the request flow identifier. When a flow update request uses a UFID that misses the UFID lookup and falls back to th...