CVE-2026-74471 tracing: Check return value of __register_event() in trace_module_add_events()

In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of registerevent in tracemoduleaddevents tracemoduleaddevents ignores the return value of registerevent and unconditionally calls addeventtotracers for each event. If registerevent fails for example, i...

CVE-2026-74472

CVE-2026-74472 affects the Linux kernel ublk path. The vulnerability arises because ublk_ctrl_add_dev() memcpy()s userspace dev_info into ub->dev_info but does not reset two driver-owned fields: ->state and ->ublksrv_pid. This can cause a device added with state LIVE to pass a test for “...

CVE-2026-74472 ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()

In the Linux kernel, the following vulnerability has been resolved: ublk: reset kernel-owned devinfo fields in ublkctrladddev ublkctrladddev memcpys the userspace ublksrvctrldevinfo into ub-devinfo and then fixes up the fields the driver owns, but misses -state and -ublksrvpid. A device added wit...

EUVD-2026-59658

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix potential UAF on meter attach failure While attaching a newly created meter attachmeter function makes the new meter visible to other CPUs but can still fail afterwards. On failure, it detaches the meter bac...

CVE-2026-74465 net: openvswitch: fix potential UAF on meter attach failure

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix potential UAF on meter attach failure While attaching a newly created meter attachmeter function makes the new meter visible to other CPUs but can still fail afterwards. On failure, it detaches the meter bac...

CVE-2026-74465 net: openvswitch: fix potential UAF on meter attach failure

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix potential UAF on meter attach failure While attaching a newly created meter attachmeter function makes the new meter visible to other CPUs but can still fail afterwards. On failure, it detaches the meter bac...

CVE-2026-74465

The CVE-2026-74465 entry describes a potential use-after-free in Linux kernel/Open vSwitch meter handling: attach_meter() may briefly expose a newly created meter and later free it on failure via ovs_meter_cmd_set(), risking UAF if RC reader/window timing allows access. The fix (per the reports) ...

CVE-2026-74465

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix potential UAF on meter attach failure While attaching a newly created meter attachmeter function makes the new meter visible to other CPUs but can still fail afterwards. On failure, it detaches the meter bac...

CVE-2026-74461 i2c: imx: Cancel hrtimer before clearing slave pointer

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

CVE-2026-74461

Summary (CVE-2026-74461) In the Linux kernel’s i2c_imx driver, the failure path occurs when an interrupt-driven hrtimer can fire after the slave pointer is set to NULL but before the pointer is cleared, leading to a use-after-free/NULL pointer dereference in the timer callback (i2c_imx_slave_fini...

CVE-2026-74461 i2c: imx: Cancel hrtimer before clearing slave pointer

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

EUVD-2026-59654

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

CVE-2026-74461

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

CVE-2026-74456

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: peakusbstart: fix double free of transfer buffer on URB submit error In peakusbstart, each RX URB transfer buffer is allocated with kmalloc and the URB is flagged URBFREEBUFFER so that the final usbfreeurb also free...

CVE-2026-74456 can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: peakusbstart: fix double free of transfer buffer on URB submit error In peakusbstart, each RX URB transfer buffer is allocated with kmalloc and the URB is flagged URBFREEBUFFER so that the final usbfreeurb also free...

EUVD-2026-59649

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: peakusbstart: fix double free of transfer buffer on URB submit error In peakusbstart, each RX URB transfer buffer is allocated with kmalloc and the URB is flagged URBFREEBUFFER so that the final usbfreeurb also free...

CVE-2026-74456

Summary (CVE-2026-74456): In the Linux kernel, the peak_usb path has a double-free in peak_usb_start() when URB_SUBMIT fails. Each RX URB transfer buffer is allocated with kmalloc() and flagged URB_FREE_BUFFER so that usb_free_urb() frees the transfer buffer. If usb_submit_urb() fails, the error ...

CVE-2026-74456 can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: peakusbstart: fix double free of transfer buffer on URB submit error In peakusbstart, each RX URB transfer buffer is allocated with kmalloc and the URB is flagged URBFREEBUFFER so that the final usbfreeurb also free...

CVE-2026-74450 drm/amd/pm: fix pptable use-after-free

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpudpmgetpptable returns a pointer to a driver-owned power table after dropping adev-pm.mutex. The sysfs path then copies from that pointer. A concurrent pptable write can replace and fre...

EUVD-2026-59643

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpudpmgetpptable returns a pointer to a driver-owned power table after dropping adev-pm.mutex. The sysfs path then copies from that pointer. A concurrent pptable write can replace and fre...