CVE-2026-74728

In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL baddr in xfsbuffree When xfsbufallocbackingmem fails, xfsbuffree is called with bp-baddr still NULL. The code falls through to the folioput path which calls virttofolioNULL, dereferencing an invalid address and...

CVE-2026-74633

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL eventmod-match when foo has not been loaded. If a later write tries to remove a specific matc...

CVE-2026-74591

In the Linux kernel, the following vulnerability has been resolved: mm/filemap: filemapaddfolio restore index before retrying In filemapaddfolio's split-a-conflict loop, xassetorder is applied repeatedly: each application modifies xas.xaindex, rounding it down according to the splitorder attempte...

CVE-2026-74728

CVE-2026-74728 is a NULL pointer dereference in the Linux kernel's XFS filesystem repair tooling. When xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with bp->b_addr still NULL. The code then falls through to the folio_put path, which calls virt_to_folio(NULL), dereferencing an in...

EUVD-2026-64415

In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL baddr in xfsbuffree When xfsbufallocbackingmem fails, xfsbuffree is called with bp-baddr still NULL. The code falls through to the folioput path which calls virttofolioNULL, dereferencing an invalid address and...

CVE-2026-74728 xfs: handle NULL b_addr in xfs_buf_free

In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL baddr in xfsbuffree When xfsbufallocbackingmem fails, xfsbuffree is called with bp-baddr still NULL. The code falls through to the folioput path which calls virttofolioNULL, dereferencing an invalid address and...

EUVD-2026-64404

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fwtracer, return NULL on create error Tracer creation can fail by returning either NULL or ERRPTR. The return value is stored without a check on the device, and users treat ERRPTR and NULL the same way. This also causes...

CVE-2026-74717 net/mlx5: fw_tracer, return NULL on create error

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fwtracer, return NULL on create error Tracer creation can fail by returning either NULL or ERRPTR. The return value is stored without a check on the device, and users treat ERRPTR and NULL the same way. This also causes...

CVE-2026-74717

CVE-2026-74717 is a NULL pointer dereference in the Linux kernel's mlx5_core driver (Mellanox ConnectX network adapter), specifically in the fw_tracer subsystem. The root cause is inconsistent error handling: tracer creation could return either NULL or ERR_PTR on failure, but the core dump logic ...

CVE-2026-74715 bpf: Fix netns reference imbalance in conntrack kfuncs

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...

CVE-2026-74702

CVE-2026-74702 affects the Linux kernel vhost-scsi module. The root cause is that vhost_scsi_set_features() accepts changes to virtio feature bits (specifically VIRTIO_SCSI_F_T10_PI) after the endpoint is already active via VHOST_SCSI_SET_ENDPOINT. This leaves the prot_sgl scatterlist array as NU...

EUVD-2026-64390

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Validate T10 PI scatterlist counts When T10 PI is negotiated, vhost-scsi splits protection bytes from the data iterator before mapping the request scatterlists. A malformed request can claim protection bytes that cove...

EUVD-2026-64389

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhostscsisetupvqcmds runs from VHOSTSCSISETENDPOINT and allocates each command's protection scatterlist array protsgl according to the acknowledged VIRTIOSCSIFT10PI bit. The comma...

CVE-2026-74664 net: openvswitch: reallocate update replies for mismatched IDs

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovsflowcmdnew preallocates the optional reply skb before it takes ovsmutex and before it knows which existing flow will be updated. That is normally fine because the...

EUVD-2026-64351

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovsflowcmdnew preallocates the optional reply skb before it takes ovsmutex and before it knows which existing flow will be updated. That is normally fine because the...

CVE-2026-74664

This vulnerability affects the Linux kernel's Open vSwitch (OVS) netlink flow command handling. The root cause is in ovs_flow_cmd_new(), which preallocates the reply skb sized from the request flow identifier. When a flow update request uses a UFID that misses the UFID lookup and falls back to th...

CVE-2026-74645 mm/damon/lru_sort: error out for >10000 active_mem_bp

In the Linux kernel, the following vulnerability has been resolved: mm/damon/lrusort: error out for 10000 activemembp damosquotascore can trigger division by zero if the target value is zero. DAMONLRUSORT lets users set the target value for the hot memory scheme via activemembp parameter. It avoi...

CVE-2026-74633

CVE-2026-74633 is a NULL pointer dereference in the Linux kernel's ftrace tracing subsystem. When a module-only event filter (e.g., :mod:foo) is cached while the module is not yet loaded, event_mod->match remains NULL. A subsequent write attempting to remove a specific match from that module p...

apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack

A flaw was found in Apache Portable Runtime Utility apr-util. A remote attacker could exploit a stack recursion vulnerability by providing specially crafted XML input to a library consumer that uses the aprxmlquoteelem function. This could lead to a denial of service DoS due to an application cra...

PT-2026-79722

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw tracer, return NULL on create error Tracer creation can fail by returning either NULL or ERR PTR. The return value is stored without a check on the device, and users treat ERR PTR and NULL the same way. This also...