CVE-2026-74502

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of outcvts on rawmidi error sndumpattachlegacyrawmidi allocates the legacy conversion array ump-outcvts and, on the sndrawmidinew error path, frees it with kfree but leaves ump-outcvts pointing at the...

UBUNTU-CVE-2026-74504

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initializetimer A userspace-driven ALSA timer SNDUTIMER lets an unprivileged user set the backing sndtimer's hardware resolution to an arbitrary 64-bit value via SNDRVTIMERIOCTLCREATE...

UBUNTU-CVE-2026-74460

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the...

CVE-2026-74504

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initializetimer A userspace-driven ALSA timer SNDUTIMER lets an unprivileged user set the backing sndtimer's hardware resolution to an arbitrary 64-bit value via SNDRVTIMERIOCTLCREATE...

CVE-2026-74516

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if L2 is active and KVM is using a separate MSR bitmap to run L2. If AVIC is...

UBUNTU-CVE-2026-74508

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transaction header hidprecvctrlframe and hidprecvintrframe read skb-data0 before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mo...

UBUNTU-CVE-2026-74477

In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobeexpire Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clone path: BUG: kernel NULL pointer dereference, address:...

CVE-2026-74576

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobjext array from its own slab" avoided recursive allocation of objexts from kmalloc caches of the same...

CVE-2026-74569

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: widen NAT rewrite delta to s32 in siphelptcp siphelptcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than...

EUVD-2026-59624

In the Linux kernel, the following vulnerability has been resolved: xsk: drain continuation descs after overflow in xskbuildskb Fix generic xmit path multi-buffer logic when packets are either too big count of descriptors exceed MAXSKBFRAGS or an invalid descriptor is included in fragmented packe...

CVE-2026-74560

In the Linux kernel, the following vulnerability has been resolved: xsk: fix buffer leak in xskdropskb for AFXDP multi-buffer Tx This patch is inspired by the check1 from sashiko. It says when overflow happens, the address of cq to be published is invalid. Actually the severer thing is the whole...

CVE-2026-74559

In the Linux kernel, the following vulnerability has been resolved: xsk: drain continuation descs after overflow in xskbuildskb Fix generic xmit path multi-buffer logic when packets are either too big count of descriptors exceed MAXSKBFRAGS or an invalid descriptor is included in fragmented packe...

CVE-2026-74556

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Bound SCSI Response data segment to the connection buffer iscsitcphdrdissect receives the data segment of several PDU types into the fixed-size conn-data buffer, which is allocated for ISCSIDEFMAXRECVSEGLEN 819...

EUVD-2026-59621

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Bound SCSI Response data segment to the connection buffer iscsitcphdrdissect receives the data segment of several PDU types into the fixed-size conn-data buffer, which is allocated for ISCSIDEFMAXRECVSEGLEN 819...

CVE-2026-74550

In the Linux kernel, the following vulnerability has been resolved: net: do not send ICMP/NDISC Redirects when peer allocation fails When inetgetpeerv4 or inetgetpeerv6 fails to allocate a peer entry under memory pressure or tree size caps, redirect handlers previously fell back to sending...

CVE-2026-74550

Summary: CVE-2026-74550 affects the Linux kernel’s redirect handling for ICMP/NDISC redirects when peer allocation fails. When inet_getpeer_v4() or inet_getpeer_v6() cannot allocate a peer entry under memory pressure or tree size caps, redirect handlers previously could emit un-rate-limited ICMP/...

CVE-2026-74550 net: do not send ICMP/NDISC Redirects when peer allocation fails

In the Linux kernel, the following vulnerability has been resolved: net: do not send ICMP/NDISC Redirects when peer allocation fails When inetgetpeerv4 or inetgetpeerv6 fails to allocate a peer entry under memory pressure or tree size caps, redirect handlers previously fell back to sending...

CVE-2026-74550 net: do not send ICMP/NDISC Redirects when peer allocation fails

In the Linux kernel, the following vulnerability has been resolved: net: do not send ICMP/NDISC Redirects when peer allocation fails When inetgetpeerv4 or inetgetpeerv6 fails to allocate a peer entry under memory pressure or tree size caps, redirect handlers previously fell back to sending...

EUVD-2026-59615

In the Linux kernel, the following vulnerability has been resolved: net: do not send ICMP/NDISC Redirects when peer allocation fails When inetgetpeerv4 or inetgetpeerv6 fails to allocate a peer entry under memory pressure or tree size caps, redirect handlers previously fell back to sending...

CVE-2026-74549

In the Linux kernel, the following vulnerability has been resolved: hwmon: nct6775-core Prevent access to unsupported weight registers Sashiko reports: During initialization of the nct6116 chip, the driver sets data-pwmnum to 5. However, it assigns several NCT6106 register arrays such as...