CVE-2026-74508 Bluetooth: HIDP: reject frames without a transaction header

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transaction header hidprecvctrlframe and hidprecvintrframe read skb-data0 before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mo...

CVE-2026-74507 Bluetooth: HIDP: validate numbered report payloads

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidpgetrawreport waits for a numbered report, hidpprocessdata compares the expected report number with skb-data0. A connected HIDP peer can reply with only a DATA transactio...

EUVD-2026-59697

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initializetimer A userspace-driven ALSA timer SNDUTIMER lets an unprivileged user set the backing sndtimer's hardware resolution to an arbitrary 64-bit value via SNDRVTIMERIOCTLCREATE...

CVE-2026-74504 ALSA: seq: Fix division by zero in initialize_timer()

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initializetimer A userspace-driven ALSA timer SNDUTIMER lets an unprivileged user set the backing sndtimer's hardware resolution to an arbitrary 64-bit value via SNDRVTIMERIOCTLCREATE...

CVE-2026-74504

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initializetimer A userspace-driven ALSA timer SNDUTIMER lets an unprivileged user set the backing sndtimer's hardware resolution to an arbitrary 64-bit value via SNDRVTIMERIOCTLCREATE...

CVE-2026-74504 ALSA: seq: Fix division by zero in initialize_timer()

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initializetimer A userspace-driven ALSA timer SNDUTIMER lets an unprivileged user set the backing sndtimer's hardware resolution to an arbitrary 64-bit value via SNDRVTIMERIOCTLCREATE...

CVE-2026-74497 ALSA: usb-audio: Clamp frame size in implicit-feedback mode

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode sndusbhandlesyncurb scales received sync packet sizes by the sender's stride and stores the result directly in outpacket-packetsizei. If a connected USB device sends an...

CVE-2026-74497

CVE-2026-74497 affects the Linux kernel (ALSA USB audio). The flaw arises in snd_usb_handle_sync_urb(), which scales received sync packet sizes by the sender’s stride and stores them directly in out_packet->packet_size[i]. An oversized sync packet can cause the calculated frame count to exceed...

CVE-2026-74496

In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in foucreate foucreate publishes struct fou through skuserdata before adding the new FOU port to the per-netns list. If fouaddtoportlist fails, the error path frees fou while it is still reachable through...

CVE-2026-74494

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject repeated SMB2 NEGOTIATE requests Unauthenticated client can send multiple successful SMB2 NEGOTIATE requests on one connection before SESSIONSETUP. While the connection is in KSMBDSESSNEEDSETUP, smb2handlenegotiate...

CVE-2026-74494

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject repeated SMB2 NEGOTIATE requests Unauthenticated client can send multiple successful SMB2 NEGOTIATE requests on one connection before SESSIONSETUP. While the connection is in KSMBDSESSNEEDSETUP, smb2handlenegotiate...

CVE-2026-74493

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket use-after-free during link group termination smclgrterminate drops connslock after finding a connection in lgr-connsall, but before taking a reference on its socket. The connection is embedded in the socket, a...

CVE-2026-74486

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: use exefiledenywriteaccess for the interpreter clone For MISCFMTOPENFILE entries loadmiscbinary clones the registered interpreter file and denies write access to the clone via plain denywriteaccess. The clone is...

EUVD-2026-59677

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't let an 'F' entry pin its own instance An entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed. Any entry nobody removes by hand only gets closed once...

CVE-2026-74484

CVE-2026-74484 concerns the Linux kernel’s binfmt_misc feature: an entry registered with the character 'F' can cause the interpreter to pin itself, preventing proper unregistration and leading to a DoS with leaked resources (including user namespaces). The issue arises when the interpreter’s file...

EUVD-2026-59676

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't leak the user namespace when the mount fails bmgettree takes a reference to the user namespace and hands it to gettreekeyed as the sget key. sgetfc moves that reference into sb-sfsinfo and clears fc-sfsinfo, so...

EUVD-2026-59673

In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group brmulticastleavegroup iterates mp-ports with pp = &p-next in its fast-leave path. After brmulticastdelpg removes p, continuing the loop advances pp through the deleted entr...

CVE-2026-74477

In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobeexpire Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clone path: BUG: kernel NULL pointer dereference, address:...

CVE-2026-74469

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sockdiag uses transportcount t...

CVE-2026-74469

The CVE-2026-74469 issue in the Linux kernel concerns SCTP: sctp_assoc_add_peer() increments a 16-bit transport_count for each new unique peer, wrapping to zero at 65,536. SCTP sock_diag reserves payload using transport_count and, after the wrap, writes 8 MiB of peer addresses past the skb tail. ...