CVE-2026-74489 wifi: mac80211: fix tid_tx use-after-free on BA session stop

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix tidtx use-after-free on BA session stop ieee80211stoptxbacb hands tidtx to kfreercu through ieee80211removetidtx, and then reads tidtx-ndp after dropping sta-lock: ieee80211removetidtxsta, tid; / kfreercutidtx...

CVE-2026-74489

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix tidtx use-after-free on BA session stop ieee80211stoptxbacb hands tidtx to kfreercu through ieee80211removetidtx, and then reads tidtx-ndp after dropping sta-lock: ieee80211removetidtxsta, tid; / kfreercutidtx...

EUVD-2026-59682

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix tidtx use-after-free on BA session stop ieee80211stoptxbacb hands tidtx to kfreercu through ieee80211removetidtx, and then reads tidtx-ndp after dropping sta-lock: ieee80211removetidtxsta, tid; / kfreercutidtx...

CVE-2026-74489 wifi: mac80211: fix tid_tx use-after-free on BA session stop

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix tidtx use-after-free on BA session stop ieee80211stoptxbacb hands tidtx to kfreercu through ieee80211removetidtx, and then reads tidtx-ndp after dropping sta-lock: ieee80211removetidtxsta, tid; / kfreercutidtx...

CVE-2026-74488

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex11ndispatchamsdupkt splits an A-MSDU with ieee80211amsduto8023s and walks the resulting subframes. For each subframe it passes the subframe data pointe...

EUVD-2026-59681

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex11ndispatchamsdupkt splits an A-MSDU with ieee80211amsduto8023s and walks the resulting subframes. For each subframe it passes the subframe data pointe...

CVE-2026-74488 wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex11ndispatchamsdupkt splits an A-MSDU with ieee80211amsduto8023s and walks the resulting subframes. For each subframe it passes the subframe data pointe...

CVE-2026-74488

CVE-2026-74488 affects the Linux kernel’s mwifiex TDLS A-MSDU parsing. The vulnerability arises when mwifiex_11n_dispatch_amsdu_pkt() processes A-MSDU subframes: it passes skb->len (the A-MSDU’s length) to mwifiex_process_tdls_action_frame() instead of rx_skb->len (the actual subframe lengt...

CVE-2026-74488 wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex11ndispatchamsdupkt splits an A-MSDU with ieee80211amsduto8023s and walks the resulting subframes. For each subframe it passes the subframe data pointe...

CVE-2026-74488

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex11ndispatchamsdupkt splits an A-MSDU with ieee80211amsduto8023s and walks the resulting subframes. For each subframe it passes the subframe data pointe...

CVE-2026-74482 mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: unlock immaprwsem before releasing after-split folios foliosplit keeps dereferencing the mapping after the split: shmemunchargemapping-host and remappage while the folios are still frozen/locked, and...

CVE-2026-74482

CVE-2026-74482 — Linux kernel (mm/huge_memory) . The issue arises during THP folio splitting in mm/huge_memory.c: __folio_split dereferences the mapping after the split while folios are still frozen/locked, and calls remap_page() and shmem_uncharge() before unlocking the after-split folios. This ...

EUVD-2026-59675

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: unlock immaprwsem before releasing after-split folios foliosplit keeps dereferencing the mapping after the split: shmemunchargemapping-host and remappage while the folios are still frozen/locked, and...

CVE-2026-74482 mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: unlock immaprwsem before releasing after-split folios foliosplit keeps dereferencing the mapping after the split: shmemunchargemapping-host and remappage while the folios are still frozen/locked, and...

CVE-2026-74481

In the Linux kernel, the following vulnerability has been resolved: mm/pagereporting: use systemfreezablewq to fix UAF during suspend During PM freeze e.g. S3 suspend or S4 hibernation, device drivers like virtioballoon reset their underlying virtio devices and delete their virtqueues via...

EUVD-2026-59674

In the Linux kernel, the following vulnerability has been resolved: mm/pagereporting: use systemfreezablewq to fix UAF during suspend During PM freeze e.g. S3 suspend or S4 hibernation, device drivers like virtioballoon reset their underlying virtio devices and delete their virtqueues via...

CVE-2026-74481

The CVE-2026-74481 entry describes a Linux kernel UAF/GPF during PM suspend caused by page_reporting work being scheduled on the non-freezable system_wq. Child devices (e.g., virtio_balloon) delete virtqueues as part of suspend, but page_reporting_process could still run, triggering virtballoon_f...

CVE-2026-74481 mm/page_reporting: use system_freezable_wq to fix UAF during suspend

In the Linux kernel, the following vulnerability has been resolved: mm/pagereporting: use systemfreezablewq to fix UAF during suspend During PM freeze e.g. S3 suspend or S4 hibernation, device drivers like virtioballoon reset their underlying virtio devices and delete their virtqueues via...

CVE-2026-74481 mm/page_reporting: use system_freezable_wq to fix UAF during suspend

In the Linux kernel, the following vulnerability has been resolved: mm/pagereporting: use systemfreezablewq to fix UAF during suspend During PM freeze e.g. S3 suspend or S4 hibernation, device drivers like virtioballoon reset their underlying virtio devices and delete their virtqueues via...

CVE-2026-74479

In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix proc entry use-after-free pktgenchangename replaces pktdev-entry while holding t-iflock. pktgenremovedevice removes the same entry before remdevfromiflist takes that lock. This allows the following interleaving:...