CVE-2026-74575

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tbxdphandlerequest runs on systemwq and queues xd-statework via queuedelayedwork in three request handlers: PROPERTIESCHANGEDREQUEST, UUIDREQUEST via...

CVE-2026-74575 thunderbolt: Prevent XDomain delayed work use-after-free on disconnect

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tbxdphandlerequest runs on systemwq and queues xd-statework via queuedelayedwork in three request handlers: PROPERTIESCHANGEDREQUEST, UUIDREQUEST via...

CVE-2026-74574 dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix fdev setup failure cleanup in idxdcdevopen The faileddevadd and faileddevname paths drop the file-device reference while wq-wqlock is still held. If putdevicefdev drops the last reference, idxdfiledevrelease...

EUVD-2026-59639

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix fdev setup failure cleanup in idxdcdevopen The faileddevadd and faileddevname paths drop the file-device reference while wq-wqlock is still held. If putdevicefdev drops the last reference, idxdfiledevrelease...

CVE-2026-74574

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix fdev setup failure cleanup in idxdcdevopen The faileddevadd and faileddevname paths drop the file-device reference while wq-wqlock is still held. If putdevicefdev drops the last reference, idxdfiledevrelease...

CVE-2026-74574

CVE-2026-74574 affects the Linux kernel’s dmaengine idxd open path, where error paths in fdev setup could deadlock by dropping the file-device reference while wq->wq_lock is held and then re-acquiring it during release. The description explains that failed_dev_add/failed_dev_name paths drop re...

CVE-2026-74569

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: widen NAT rewrite delta to s32 in siphelptcp siphelptcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than...

CVE-2026-74569 netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: widen NAT rewrite delta to s32 in siphelptcp siphelptcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than...

CVE-2026-74569

CVE-2026-74569 affects the Linux kernel netfilter nf_conntrack_sip path. The issue stems from NAT rewrite delta handling in sip_help_tcp(), where diff/tdiff was stored in 16-bit fields and could overflow within large SIP messages, causing a read past the skb tail. The fix widens diff, tdiff, and ...

CVE-2026-74569 netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: widen NAT rewrite delta to s32 in siphelptcp siphelptcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than...

EUVD-2026-59634

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: widen NAT rewrite delta to s32 in siphelptcp siphelptcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than...

CVE-2026-74568

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Fix race between LPI release and re-registration Fix a potential race between decrementing an LPI's reference count and evicting that structure from the LPI xarray. LPI structures are maintained in the VGIC LPI...

EUVD-2026-59633

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Fix race between LPI release and re-registration Fix a potential race between decrementing an LPI's reference count and evicting that structure from the LPI xarray. LPI structures are maintained in the VGIC LPI...

CVE-2026-74568 KVM: arm64: vgic: Fix race between LPI release and re-registration

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Fix race between LPI release and re-registration Fix a potential race between decrementing an LPI's reference count and evicting that structure from the LPI xarray. LPI structures are maintained in the VGIC LPI...

CVE-2026-74568

CVE-2026-74568 (Linux kernel, KVM arm64 vgic) : A race between LPIs release and re-registration can occur when an LPI’s reference count drops to zero and the LPI entry is evicted from the VGIC LPI xarray, enabling a concurrent re-registration to overwrite or leak LPIs. The issue arises because th...

CVE-2026-74565 netfilter: nf_tables: make nft_object rhltable per table

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: make nftobject rhltable per table The nftobject rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nftobjdestroy releases the...

CVE-2026-74565 netfilter: nf_tables: make nft_object rhltable per table

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: make nftobject rhltable per table The nftobject rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nftobjdestroy releases the...

CVE-2026-74565

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: make nftobject rhltable per table The nftobject rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nftobjdestroy releases the...

CVE-2026-74565

Consolidated sources describe CVE-2026-74565 affecting the Linux kernel netfilter nf_tables. The bug arises from a global rhltable for nft_object, enabling access to objects being disassembled from lookup paths across net namespaces and potentially causing use-after-free when nft_obj_destroy() re...

EUVD-2026-59630

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: make nftobject rhltable per table The nftobject rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nftobjdestroy releases the...