CVE-2026-74293

In the Linux kernel ASoC subsystem for Freescale (fsl) audio mixer, CVE-2026-74293 concerns fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src(). These callbacks convert a user-supplied enum item to a value with snd_soc_enum_item_to_val() before validating it against the enum’s item count, w...

EUVD-2026-59439

In the Linux kernel, the following vulnerability has been resolved: ASoC: tegra: tegra210ahub: Validate written enum value tegraahubputvalueenum reads e-valuesitem0 before checking whether item0 is within the enum item range. The existing check therefore happens too late to prevent an out-of-rang...

CVE-2026-74291 ASoC: topology: Check PCM and DAI name strings before use

In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen checks before using them...

CVE-2026-74291 ASoC: topology: Check PCM and DAI name strings before use

In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen checks before using them...

CVE-2026-74291

CVE-2026-74291 concerns the Linux kernel ASoC topology parser. Affected: PCM/DAI name fields stored in fixed-size UAPI arrays. Root cause: those PCM/DAI paths forwarded non-NUL-terminated or unterminated name strings to C-strings, strlen(), and related lookups without prior bounded checks. Conseq...

EUVD-2026-59438

In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen checks before using them...

EUVD-2026-59426

In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sgcleanup error path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

CVE-2026-74279 crypto: cavium/cpt - fix DMA cleanup using wrong loop index

In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sgcleanup error path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

CVE-2026-74280

The CVE-2026-74280 entry concerns the Linux kernel crypto: marvell/octeontx component where DMA cleanup used the wrong loop index. Specifically, the sg_cleanup path unmaps DMA buffers using list[i] instead of list[j], leading to leaking successfully mapped entries and repeatedly unmapping the fai...

CVE-2026-74276

Summary : CVE-2026-74276 documents a Linux kernel SPI/Xilinx driver issue where the TX FIFO size was miscomputed due to querying FULL and relying on the TX FIFO to reflect the actual buffer, ignoring the shift register. The result can be an over-read (example: 17 bytes for a 16-byte FIFO) leading...

CVE-2026-74276 spi: xilinx: use FIFO occupancy register to determine buffer size

In the Linux kernel, the following vulnerability has been resolved: spi: xilinx: use FIFO occupancy register to determine buffer size The method the driver uses to determine the size of the FIFO has a problem. What it currently does is this: It stops the SPI hardware and writes to the TX FIFO...

CVE-2026-74277 iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path

In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommudmamapsg, when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment s is incorrectly assigned from the head entry sg-length...

CVE-2026-74276 spi: xilinx: use FIFO occupancy register to determine buffer size

In the Linux kernel, the following vulnerability has been resolved: spi: xilinx: use FIFO occupancy register to determine buffer size The method the driver uses to determine the size of the FIFO has a problem. What it currently does is this: It stops the SPI hardware and writes to the TX FIFO...

EUVD-2026-59423

In the Linux kernel, the following vulnerability has been resolved: spi: xilinx: use FIFO occupancy register to determine buffer size The method the driver uses to determine the size of the FIFO has a problem. What it currently does is this: It stops the SPI hardware and writes to the TX FIFO...

CVE-2026-74271

CVE-2026-74271 affects the Linux kernel’s power supply core. If the device tree property power-supplies has multiple values, accessing psy->supplied_from[i-1] in __power_supply_populate_supplied_from can overrun the supplied_from array. The patch fixes supplied_from allocations to prevent the ...

EUVD-2026-59418

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: fix suppliedfrom allocations If dts property power-supplies has multiple values, then accessing to psy-suppliedfromi-1 in powersupplypopulatesuppliedfrom will overrun suppliedfrom array...

CVE-2026-74271 power: supply: core: fix supplied_from allocations

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: fix suppliedfrom allocations If dts property power-supplies has multiple values, then accessing to psy-suppliedfromi-1 in powersupplypopulatesuppliedfrom will overrun suppliedfrom array...

CVE-2026-74271 power: supply: core: fix supplied_from allocations

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: fix suppliedfrom allocations If dts property power-supplies has multiple values, then accessing to psy-suppliedfromi-1 in powersupplypopulatesuppliedfrom will overrun suppliedfrom array...

CVE-2026-74262

In the Linux kernel, the following vulnerability has been resolved: kcm: use WRITEONCE when changing lower socket callbacks kcmattach replaces a live lower TCP socket's skdataready and skwritespace callbacks with KCM handlers, and kcmunattach restores them later. Those callback-pointer updates ar...

CVE-2026-72497 RDMA/bnxt_re: Add a max slot check for SQ

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Add a max slot check for SQ The variable WQE mode must be validated against the maximum slots supported by HW. The max supported value is 64K. Adding a max and min check and fail if user supplied value is more than t...