CVE-2026-74308

In the Linux kernel, the following vulnerability has been resolved: ext4: fix kernel BUG in ext4writeinlinedataend When the data=journal mount option is used, the ext4journalledwriteend function incorrectly calls ext4writeinlinedataend without checking if the EXT4STATEMAYINLINEDATA flag is still...

CVE-2026-74306

In the Linux kernel, the following vulnerability has been resolved: vfio/qat: fix fpos race in qatvfresumewrite qatvfresumewrite checks filp-fpos before taking migf-lock, but copies into the migration-state buffer after taking the lock and re-reading the shared file position. Two concurrent write...

CVE-2026-74307

In the Linux kernel, the following vulnerability has been resolved: ext4: validate donor file superblock early in EXT4IOCMOVEEXT Reject the EXT4IOCMOVEEXT ioctl early if the donor file does not belong to the same superblock as the original file. Currently, this validation is performed inside...

CVE-2026-74305

In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 "bpf: Fix oob access in cgroup local storage" is still incomplete. The prog-array compatibility check treats a program with no cgroup storag...

CVE-2026-74303

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

CVE-2026-74302 Bluetooth: hci_core: Fix UAF in hci_unregister_dev()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix UAF in hciunregisterdev hciunregisterdev does not disable cmdtimer and ncmdtimer before the hcidev structure is freed. If a timeout fires during device teardown, the callback dereferences freed memory...

CVE-2026-74302

The CVE-2026-74302 issue affects the Linux kernel Bluetooth HCI core, specifically hci_unregister_dev(), where cmd_timer and ncmd_timer are not disabled before freeing the hci_dev, leading to use-after-free. The documented fix adds disable_delayed_work_sync() alongside existing disable_work_sync(...

CVE-2026-74302

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix UAF in hciunregisterdev hciunregisterdev does not disable cmdtimer and ncmdtimer before the hcidev structure is freed. If a timeout fires during device teardown, the callback dereferences freed memory...

EUVD-2026-59449

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix UAF in hciunregisterdev hciunregisterdev does not disable cmdtimer and ncmdtimer before the hcidev structure is freed. If a timeout fires during device teardown, the callback dereferences freed memory...

CVE-2026-74302 Bluetooth: hci_core: Fix UAF in hci_unregister_dev()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix UAF in hciunregisterdev hciunregisterdev does not disable cmdtimer and ncmdtimer before the hcidev structure is freed. If a timeout fires during device teardown, the callback dereferences freed memory...

CVE-2026-74301

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix URB leak in allocmtkintrurb error path When btmtkisopktpad fails, the previously allocated URB is not freed, leaking the urb structure. Add usbfreeurb before returning the error...

CVE-2026-74300

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes...

CVE-2026-74299

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix FRMR aging push to queue error flow Aging pools with pinned handles requires moving handles from the active queue to a non-empty inactive queue that might fail on new page allocation, we are currently not handling...

CVE-2026-74298

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix FRMR set pinned push error path Add destruction of FRMR handles in case the push to the pool fails. This prevents resources leak in case pool page allocation fails...

CVE-2026-74297

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix undefined shift of user RQ WQE size setrqsize computes the RQ WQE size as "1 rqwqeshift" based on the user-provided rqwqeshift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shi...

CVE-2026-74296 RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Free the UAR index returned by the hardware...

CVE-2026-74295

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: hdachdmi: Validate written enum value hdachdmisetpinportmux uses the written enum value to index the texts array before calling sndsocdapmputenumdouble, which validates that the value is within the enum item range. ...

CVE-2026-74296

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Free the UAR index returned by the hardware...

CVE-2026-74294

In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: aiu: Validate written enum values The AIU HDMI and internal codec mux put callbacks use the written enum value with sndsocenumitemtoval before checking whether the value is valid for the enumeration. Reject...

CVE-2026-74293

In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl: fslaudmix: Validate written enum values fslaudmixputmixclksrc and fslaudmixputoutsrc convert the user-provided enum item with sndsocenumitemtoval before checking whether the item is within the enum's item count. The...