EUVD-2026-59670

In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobeexpire Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clone path: BUG: kernel NULL pointer dereference, address:...

CVE-2026-74472 ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()

In the Linux kernel, the following vulnerability has been resolved: ublk: reset kernel-owned devinfo fields in ublkctrladddev ublkctrladddev memcpys the userspace ublksrvctrldevinfo into ub-devinfo and then fixes up the fields the driver owns, but misses -state and -ublksrvpid. A device added wit...

CVE-2026-74461 i2c: imx: Cancel hrtimer before clearing slave pointer

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

CVE-2026-74461

CVE-2026-74461 affects the Linux kernel i2c_imx path. The bug occurs in i2c_imx_unreg_slave(): the slave pointer is set to NULL after disabling interrupts, which can allow a pending hrtimer (i2c_imx_slave_timeout) to fire and call i2c_imx_slave_finish_op(), passing a NULL slave pointer and causin...

EUVD-2026-59654

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

EUVD-2026-59752

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DXBINDQUERY without a DX context vmwcmddxbindquery unconditionally dereferences swcontext-dxctxnode-ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbuf with...

CVE-2026-74442 drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: avoid destroyworkqueueNULL on vkms init failure Two paths through vmwvkmsinit can leave vmw-crcworkq NULL while still leaving the rest of the driver in a state that calls vmwvkmscleanup at module unload: 1...

CVE-2026-74442

CVE-2026-74442 affects the Linux kernel drm/vmwgfx/vkms code. Two code paths in vmw_vkms_init() can leave vmw->crc_workq NULL while the driver is not fully unload-safe, causing a panic when vmw_vkms_cleanup() runs destroy_workqueue(NULL). Fixes: (1) remove the early return so the workqueue is ...

EUVD-2026-59749

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: avoid destroyworkqueueNULL on vkms init failure Two paths through vmwvkmsinit can leave vmw-crcworkq NULL while still leaving the rest of the driver in a state that calls vmwvkmscleanup at module unload: 1...

CVE-2026-74429

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the reception of a reply packet before data transmission Fix rxrpcreceivingreply to handle the reception of an apparent reply DATA packet before rxrpc has had a chance to send any request DATA packets on a client call ...

CVE-2026-74430

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...

CVE-2026-74435

In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpcverifydata ensure rxdecbuffer alloc rxrpcrecvmsgdata calls rxrpcverifydata whenever the rxrpccall.rxdecbuffer is unallocated and assumes that upon successful return that rxdecbuffer must be allocated. However,...

CVE-2026-74424

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vcdata fbconnewmodelist runs when a framebuffer's modelist changes. For each console mapped to it with fbdisplayi.mode set, it reads vcconsi.d and passes the vcnum to...

CVE-2026-74426

In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afsgettree afsallocsbi uses kzalloc for memory allocation. And, if ctx-dynroot is not null, as-cell and as-volume are null. In traceafsgettree they are dereferenced. KASAN error message: KASAN...

CVE-2026-74414

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Remove the duplicate attr inode dirty marking action Syzbot reported a null-ptr-deref in 1. If the attributes file is not loaded during system mount, a trigger occurs 1 when setxattr is executed in userspace. Remove the...

CVE-2026-74418

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Fix potential tracepoint null pointer dereferences Tracedmafencesignaled, tracedmafencewaitend and tracedmafencedestroy can all currently dereference a null fence-ops pointer after it has been reset on fence signalling...

CVE-2026-74403

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Check for page allocation failure correctly in TIO Sashiko notes: if snpallocfirmwarepages returns NULL under memory pressure, is it safe to pass it directly to pageaddress? On architectures without HASHEDPAGEVIRTUA...

CVE-2026-74400

In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpfset|removedentryxattr for negative dentries bpfsetdentryxattr and bpfremovedentryxattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passe...

CVE-2026-74407

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery SSR. The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed...

CVE-2026-74406

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...