CVE-2026-74410

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer In rtwpcirxnapi, newlen is computed as the sum of pktlen 14-bit descriptor field, max 16383 and pktoffset drvinfosz + shift, both firmware-controlled. The...

CVE-2026-74411

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89hwscanaddchanax for over 20 seconds, leading to a system...

CVE-2026-74409

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware macid in link lookup The macid field in RX descriptors is 8 bits wide 0-255, but assoclinkonmacid has only RTW89MAXMACIDNUM 128 entries. While the driver currently assigns macid values...

CVE-2026-74408

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...

CVE-2026-74407

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery SSR. The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed...

CVE-2026-74406

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...

EUVD-2026-59552

In the Linux kernel, the following vulnerability has been resolved: OPP: Fix race between OPP addition and lookup A race exists between devpmoppadddynamic and devpmoppfindfreqexact: CPU0 add CPU1 lookup ------------------------------- ------------------------------ oppadd mutexlock...

CVE-2026-74405

In the Linux kernel, the following vulnerability has been resolved: OPP: Fix race between OPP addition and lookup A race exists between devpmoppadddynamic and devpmoppfindfreqexact: CPU0 add CPU1 lookup ------------------------------- ------------------------------ oppadd mutexlock...

CVE-2026-74404

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix snpfilterreservedmemregions off-by-one Sashiko notes: regarding the bounds check in snpfilterreservedmemregions called via walkiomemresdesc: does the check if rangelist-numelements 16 + 8 PAGESIZE allow an...

CVE-2026-74405 OPP: Fix race between OPP addition and lookup

In the Linux kernel, the following vulnerability has been resolved: OPP: Fix race between OPP addition and lookup A race exists between devpmoppadddynamic and devpmoppfindfreqexact: CPU0 add CPU1 lookup ------------------------------- ------------------------------ oppadd mutexlock...

CVE-2026-74403

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Check for page allocation failure correctly in TIO Sashiko notes: if snpallocfirmwarepages returns NULL under memory pressure, is it safe to pass it directly to pageaddress? On architectures without HASHEDPAGEVIRTUA...

EUVD-2026-59548

In the Linux kernel, the following vulnerability has been resolved: dlm: fix add msg handle in sendqueue ordered In a benchmark scenario triggering a lot of requests that triggers a lot of DLM messages on the network it can be that the mh-seq is not ordered according the oldest seq number. This...

CVE-2026-74401 dlm: fix add msg handle in send_queue ordered

In the Linux kernel, the following vulnerability has been resolved: dlm: fix add msg handle in sendqueue ordered In a benchmark scenario triggering a lot of requests that triggers a lot of DLM messages on the network it can be that the mh-seq is not ordered according the oldest seq number. This...

CVE-2026-74402

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix blocking and non-blocking rng logic The blocking and non-blocking paths were failing to provide valid entropy due to improper buffer management. Reading the buffer starting from byte 1, only fetch the ...

CVE-2026-74401

In the Linux kernel, the following vulnerability has been resolved: dlm: fix add msg handle in sendqueue ordered In a benchmark scenario triggering a lot of requests that triggers a lot of DLM messages on the network it can be that the mh-seq is not ordered according the oldest seq number. This...

CVE-2026-74401

The CVE-2026-74401 issue affects the Linux kernel’s DLM code, where mh->seq could be out of order in the send_queue, potentially impacting older sequence numbers and causing refcounting issues and use-after-free. The root cause is the improper ordering in send_queue handling as checked by dlm_...

CVE-2026-74400

In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpfset|removedentryxattr for negative dentries bpfsetdentryxattr and bpfremovedentryxattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passe...

CVE-2026-74398 ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD

In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: bail out of dadfailure when state is no longer POSTDAD addrconfdadfailure transitions ifp-state from DAD to POSTDAD via addrconfdadend, which drops ifp-lock on return. The lock is re-acquired after...

EUVD-2026-59545

In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: bail out of dadfailure when state is no longer POSTDAD addrconfdadfailure transitions ifp-state from DAD to POSTDAD via addrconfdadend, which drops ifp-lock on return. The lock is re-acquired after...

CVE-2026-74398 ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD

In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: bail out of dadfailure when state is no longer POSTDAD addrconfdadfailure transitions ifp-state from DAD to POSTDAD via addrconfdadend, which drops ifp-lock on return. The lock is re-acquired after...