EUVD-2026-59543

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure mlx5rumrupdatexlt allocates and DMA maps an XLT buffer with mlx5rumrcreatexlt. The buffer is released by the common cleanup path through mlx5rumrunmapfreexlt. After...

CVE-2026-74385 nvmet-tcp: check return value of nvmet_tcp_set_queue_sock

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check return value of nvmettcpsetqueuesock The return value of nvmettcpsetqueuesock is currently ignored in nvmettcptlshandshakedone. If it fails e.g., due to the socket not being in TCPESTABLISHED state, the socket...

CVE-2026-74385 nvmet-tcp: check return value of nvmet_tcp_set_queue_sock

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check return value of nvmettcpsetqueuesock The return value of nvmettcpsetqueuesock is currently ignored in nvmettcptlshandshakedone. If it fails e.g., due to the socket not being in TCPESTABLISHED state, the socket...

EUVD-2026-59526

In the Linux kernel, the following vulnerability has been resolved: dax/kmem: account for partial discontiguous resource upon removal When devdaxkmemprobe partially succeeds at least one range is mapped but a subsequent range fails requestmemregion or addmemorydrivermanaged, the probe silently...

CVE-2026-74379

In the Linux kernel, the following vulnerability has been resolved: dax/kmem: account for partial discontiguous resource upon removal When devdaxkmemprobe partially succeeds at least one range is mapped but a subsequent range fails requestmemregion or addmemorydrivermanaged, the probe silently...

CVE-2026-74367

CVE-2026-74367 describes a Linux kernel vulnerability in the ath12k WiFi driver (ath12k_mac_vdev_create) where three error-paths can leave arvif in an inconsistent state. Specifically: (1) on failure of ath12k_wmi_vdev_create, arvif->ar isn’t cleared, making vdev readiness checks see a non-NUL...

CVE-2026-74280

The CVE-2026-74280 entry concerns the Linux kernel crypto: marvell/octeontx component where DMA cleanup used the wrong loop index. Specifically, the sg_cleanup path unmaps DMA buffers using list[i] instead of list[j], leading to leaking successfully mapped entries and repeatedly unmapping the fai...

CVE-2026-74280 crypto: marvell/octeontx - fix DMA cleanup using wrong loop index

In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sgcleanup path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

CVE-2026-74279

The CVE-2026-74279 issue affects the Linux kernel crypto: cavium/cpt path, where the sg_cleanup error path used list[i] instead of list[j] when unmapping DMA buffers. This incorrect loop indexing could leak entries that were previously mapped and repeatedly unmap the failed entry. The vulnerabili...

CVE-2026-74280 crypto: marvell/octeontx - fix DMA cleanup using wrong loop index

In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sgcleanup path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

CVE-2026-74279 crypto: cavium/cpt - fix DMA cleanup using wrong loop index

In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sgcleanup error path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

CVE-2026-74279 crypto: cavium/cpt - fix DMA cleanup using wrong loop index

In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sgcleanup error path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

CVE-2026-74265 net: mana: initialize gdma queue id to INVALID_QUEUE_ID

In the Linux kernel, the following vulnerability has been resolved: net: mana: initialize gdma queue id to INVALIDQUEUEID managdcreatemanawqcq leaves queue-id as 0 from kzallocobj until manacreatewqobj assigns the firmware-returned id. If creation fails before that, cleanup calls managddestroycq...

CVE-2026-74265

The CVE describes a Linux kernel fix in net: mana where gdma queue id is now initialized to INVALID_QUEUE_ID immediately after allocation. Previously, mana_gd_create_mana_wq_cq() left queue->id as 0 until mana_create_wq_obj() set the firmware-returned id; if creation failed before that, cleanu...

CVE-2026-74265 net: mana: initialize gdma queue id to INVALID_QUEUE_ID

In the Linux kernel, the following vulnerability has been resolved: net: mana: initialize gdma queue id to INVALIDQUEUEID managdcreatemanawqcq leaves queue-id as 0 from kzallocobj until manacreatewqobj assigns the firmware-returned id. If creation fails before that, cleanup calls managddestroycq...

CVE-2026-72485 coresight: platform: defer connection counter increment until alloc succeeds

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...

CVE-2026-72475 dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: Properly free struct axidmacdesc Use axidmacfreedesc to free fully the descriptor at fail path when call axidmacallocdesc in axidmacprepperipheraldmavec...

EUVD-2026-59325

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer spill metadata during half-slot cleanup cleanfuncstate cleans dead stack slots in 4-byte halves. When the high half of a STACKSPILL slot is dead and the low half remains live, cleanup converts the live low...

CVE-2026-72426

The CVE-2026-72426 entry describes a Linux kernel vulnerability affecting BPF stack slot cleanup. When cleaning dead stack slots in 4-byte halves, if the high half of a STACK_SPILL is dead and the low half remains live, the low half could be converted to STACK_MISC/STACK_ZERO and its spilled_ptr ...

CVE-2026-72426 bpf: Preserve pointer spill metadata during half-slot cleanup

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer spill metadata during half-slot cleanup cleanfuncstate cleans dead stack slots in 4-byte halves. When the high half of a STACKSPILL slot is dead and the low half remains live, cleanup converts the live low...