CVE-2026-74304

A flaw was found in the Bluetooth subsystem of the Linux kernel, specifically within the hciqca module. This vulnerability occurs when the qcasetup function is called for hciuart devices connected through non-serdev paths, leading to a NULL pointer dereference. A local attacker could potentially...

CVE-2026-74306

A flaw was found in the Linux kernel's vfio/qat driver. This vulnerability involves a race condition in the qatvfresumewrite function, where concurrent operations can bypass a critical bounds check. This allows data to be written beyond the intended memory area, potentially corrupting system...

CVE-2026-74303

A flaw was found in the Linux kernel's Bluetooth subsystem. The qcadmphdr function, when handling non-serdev devices, attempts to dereference a NULL pointer without proper validation. An attacker could potentially trigger this condition, leading to a system crash and a denial of service...

CVE-2026-74302

A flaw was found in the Bluetooth subsystem of the Linux kernel. During the unregistration of a Bluetooth device, the system fails to properly disable timers before freeing the associated memory. This can lead to a use-after-free vulnerability, where the system attempts to access memory that has...

CVE-2026-74300

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI component. A malicious Bluetooth controller could send a specially crafted response during the 'Read Local Codec Capabilities' operation. Insufficient validation of the codec capability element length could allow the...

CVE-2026-74295

A flaw was found in the Linux kernel, specifically within the ASoC hdachdmi audio codec driver. This vulnerability occurs because the driver does not properly validate an input value used to access an internal data structure. A local attacker could provide a specially crafted input, causing the...

CVE-2026-74299

A flaw was found in the Linux kernel's RDMA/core component. When aging pools with pinned handles, a failure to move handles from the active queue to an inactive queue during new page allocation can lead to a memory leak. This occurs because the system does not properly handle the fault, resulting...

CVE-2026-74298

A flaw was found in the RDMA/core component of the Linux kernel. This vulnerability occurs when the push to the pool fails, leading to a failure in the destruction of FRMR Fast Registration Memory Region handles. This can result in a resource leak, potentially impacting system stability or...

CVE-2026-74297

A flaw was found in the Linux kernel's RDMA/mlx5 subsystem. Insufficient validation of a user-provided input, rqwqeshift, in the setrqsize function can lead to an integer overflow. This overflow results in an undefined shift operation, which may cause system instability or a denial of service...

CVE-2026-74296

A flaw was found in the RDMA/mlx5 component of the Linux kernel. This vulnerability occurs due to an incorrect User Access Register UAR index release, where the software-provided index is freed instead of the hardware-provided one. This improper resource management could potentially lead to...

CVE-2026-74294

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA System on Chip ASoC meson audio interface unit AIU component. The AIU HDMI and internal codec mux put callbacks do not properly validate enum values before processing them. This allows an attacker to provide out-of-rang...

CVE-2026-74292

A flaw was found in the Linux kernel's audio driver for Tegra devices, specifically within the AHUB component. This vulnerability arises because a function attempts to read data from an array using an index that has not been properly checked, potentially leading to access beyond the array's...

CVE-2026-74284

A flaw was found in the Linux kernel's Hierarchical Fair Service Curve HFSC queueing discipline schhfsc. When a child qdisc drops its last packets, the updatevf function can be called twice for the same class, causing it to be marked passive multiple times. This double transition can lead to a...

CVE-2026-74274

A flaw was found in the Linux kernel's CXL Compute Express Link driver. When endpoint decoders are removed from a CXL region's target array, the driver can fail to properly fill the resulting NULL pointer holes. This can lead to the system attempting to access a NULL pointer, causing a general...

CVE-2026-74291

A flaw was found in the Linux kernel's ASoC Audio System on Chip topology component. This vulnerability allows a local attacker to provide a specially crafted, malformed audio topology configuration blob with non-NUL-terminated name strings. This can cause the parser to read beyond the intended...

CVE-2026-74290

A flaw was found in the Linux kernel's clsflow module. A local user, by operating a traffic control tc classifier within a user or network namespace, could manipulate specific parameters. This manipulation allows the user to recover sensitive 32-bit folded kernel pointer values, leading to...

CVE-2026-74288

A flaw was found in the Linux kernel's networking subsystem. During the process of dumping network routing rules fibrulesdump, a race condition could occur where a 'dying' rule one being deallocated is incorrectly accessed. This could lead to a reference count error, potentially causing a system...

CVE-2026-74286

A flaw was found in the Linux kernel's Packet Forwarding Control Protocol PFCP module. The module fails to properly allocate per-CPU statistics, leaving a pointer uninitialized. A local attacker can exploit this by creating a PFCP rtnetlink device, which triggers a null pointer dereference. This...

CVE-2026-74287

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could send a specially crafted SCTP packet with a malformed embedded address parameter. This could lead to an out-of-bounds read, potentially allowing for information disclosure or...

CVE-2026-74282

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC component. A remote or local attacker could send an oversized connection acknowledgment ACK message, leading to an integer underflow. This underflow can cause the connection to become permanently congested,...