EUVD-2026-64363

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...

CVE-2026-74676

CVE-2026-74676 affects the Linux kernel virtual terminal (VT) subsystem. The KDSKBMETA ioctl, which modifies keyboard meta mode, lacked the !perm permission check enforced by all other keyboard setter ioctls in vt_k_ioctl() . This allowed a process to change the meta mode on a non-controlling con...

CVE-2026-74676 vt: add permission check for KDSKBMETA ioctl

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...

CVE-2026-74676 vt: add permission check for KDSKBMETA ioctl

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...

CVE-2026-74651 staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwgetwpaie rtwgetwpaie reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short...

CVE-2026-74651 staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwgetwpaie rtwgetwpaie reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short...

CVE-2026-74651

CVE-2026-74651 is an out-of-bounds read in the Linux kernel's rtl8723bs Wi-Fi driver (staging). The function rtw_get_wpa_ie() reads a 4-byte OUI+type and a 2-byte version word at fixed offsets into a vendor-specific information element (EID 221) without verifying the IE body is at least 6 bytes l...

CVE-2026-74650 staging: rtl8723bs: fix OOB read in WMM_param_handler()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

EUVD-2026-64587

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

EUVD-2026-64586

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

CVE-2026-74649 staging: rtl8723bs: fix missing shared-key auth challenge length check

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

EUVD-2026-64557

In the Linux kernel, the following vulnerability has been resolved: net/sched: actgact, actpolice: range check the fallback control action tcfactioncheckctrlact range checks the primary control action: if !opcode ret = action TCACTVALUEMAX ? -EINVAL : 0; TCACTVALUEMAX is TCACTTRAP, so...

CVE-2026-74620 net/sched: act_gact, act_police: range check the fallback control action

In the Linux kernel, the following vulnerability has been resolved: net/sched: actgact, actpolice: range check the fallback control action tcfactioncheckctrlact range checks the primary control action: if !opcode ret = action TCACTVALUEMAX ? -EINVAL : 0; TCACTVALUEMAX is TCACTTRAP, so...

CVE-2026-74620

This Linux kernel vulnerability affects the net/sched subsystem, specifically the act_gact and act_police traffic control actions. The fallback control actions (TCA_GACT_PROB.paction and TCA_POLICE_RESULT) bypass the range check in tcf_action_check_ctrlact(), allowing user space to store TC_ACT_C...

EUVD-2026-64558

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix skbuff leak when the header checks reject a packet tcfcthandlefragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTOIPV4 err =...

CVE-2026-74621

CVE-2026-74621 is an unbounded memory leak in the Linux kernel's net/sched: act_ct (traffic control connection-tracking action). When tcf_ct_handle_fragments() rejects a packet via header sanity checks (returning -EINVAL, -ENOMEM, or -EPROTO), the skb remains owned by the caller, yet tcf_ct_act()...

CVE-2026-74620 net/sched: act_gact, act_police: range check the fallback control action

In the Linux kernel, the following vulnerability has been resolved: net/sched: actgact, actpolice: range check the fallback control action tcfactioncheckctrlact range checks the primary control action: if !opcode ret = action TCACTVALUEMAX ? -EINVAL : 0; TCACTVALUEMAX is TCACTTRAP, so...

EUVD-2026-64541

In the Linux kernel, the following vulnerability has been resolved: Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Revert commit 030a48b0f6ce "thermal/drivers/hwmon: Cleanup coding style a bit" that introduced a use-after-free into the error path of thermaladdhwmonsysfs by removing a...

CVE-2026-74596 fs,fsverity: remove check for fsverity being enabled in setattr_prepare()

In the Linux kernel, the following vulnerability has been resolved: fs,fsverity: remove check for fsverity being enabled in setattrprepare The check that fs-verity is available in the kernel is not necessary here. Filesystems could have fsverity files even without fs-verity enabled. In that case,...

CVE-2026-74596

This vulnerability affects the Linux kernel in the fsverity (filesystem verity) subsystem. The issue is in setattr_prepare(), where an unnecessary check for whether fs-verity is enabled in the kernel was present. Filesystems can contain fsverity files even when fs-verity is not enabled, and in th...