CVE-2026-74398

CVE-2026-74398 affects the Linux kernel IPv6 address configuration (addrconf) DAD flow. The vulnerability arises when addrconf_dad_failure() transitions an interface’s state from DAD to POSTDAD and, due to a window where the interface lock is dropped, a concurrent ipv6_del_addr() can set ifp->...

CVE-2026-74397

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5iballoctransportdomain allocates a transport domain and then may fail in mlx5ibenablelb. In that case, the allocated TD is leaked. Fix this by deallocatin...

CVE-2026-74396

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure mlx5rumrupdatexlt allocates and DMA maps an XLT buffer with mlx5rumrcreatexlt. The buffer is released by the common cleanup path through mlx5rumrunmapfreexlt. After...

CVE-2026-74395

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5IBMETHODDEVXSUBSCRIBEEVENT links eventsub into sublist before initializing the fields used by the shared error path. If eventfdctxfdget then fails, the unwind path...

CVE-2026-74392

In the Linux kernel, the following vulnerability has been resolved: dm: limit target bio polling to one shot dmpollbio is the -pollbio callback for a stacked dm device. The caller only knows about the dm queue, so it may decide to do a spinning poll if it thinks a single queue is being polled...

CVE-2026-74390

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix out-of-bounds write in irdmacopyuserpgaddrs The irdmacopyuserpgaddrs function loops through all of the umem DMA blocks to populate the PBLEs and will stop when either the last DMA block is reached or palloc-totalc...

CVE-2026-74388 ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data The OSS sequencer processes the input MIDI bytes into a sequencer event to be dispatched later in sndseqossmidiputc called from sndseqossprocessevent. When it's ...

EUVD-2026-59535

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data The OSS sequencer processes the input MIDI bytes into a sequencer event to be dispatched later in sndseqossmidiputc called from sndseqossprocessevent. When it's ...

CVE-2026-74389

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix log flood after cmdmbox failure hnsrocecmdmbox is the command interface between driver and hardware. When hardware is abnormal, the unlimited error printings after hnsrocecmdmbox failure will cause log flood and eve...

CVE-2026-74388

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data The OSS sequencer processes the input MIDI bytes into a sequencer event to be dispatched later in sndseqossmidiputc called from sndseqossprocessevent. When it's ...

CVE-2026-74388

The CVE-2026-74388 issue affects the Linux kernel ALSA: seq: oss component, where SysEx handling in the OSS sequencer could lead to a use-after-free if a sequencer port closes during dispatch. The root cause is a stale pointer in a pending event held after input MIDI bytes are turned into a seque...

CVE-2026-74388 ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data The OSS sequencer processes the input MIDI bytes into a sequencer event to be dispatched later in sndseqossmidiputc called from sndseqossprocessevent. When it's ...

EUVD-2026-59534

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...

CVE-2026-74387

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...

CVE-2026-74387 ALSA: seq: midi: Serialize output teardown with event_input

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...

CVE-2026-74387

Summary of CVE-2026-74387 (Linux kernel, ALSA: seq: midi) : The vulnerability stems from improper synchronization in MIDI event handling. Specifically, event_process_midi() borrows msynth->output_rfile.output and passes the substream to dump_midi() and snd_rawmidi_kernel_write() without coordi...

CVE-2026-74385

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check return value of nvmettcpsetqueuesock The return value of nvmettcpsetqueuesock is currently ignored in nvmettcptlshandshakedone. If it fails e.g., due to the socket not being in TCPESTABLISHED state, the socket...

CVE-2026-74386

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmettcpallocqueue, when a connection is closed during the allocation process e.g., nvmettcpsetqueuesock returns -ENOTCONN, the error handling jumps to outdestroysq and the...

CVE-2026-74384

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible array member, currentpath, which is indexed using the NUMA node ID: head-currentpathnumanodeid The structure is currently allocated as...

CVE-2026-74383

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvmesetupdescriptorpools nvmesetupdescriptorpools indexes dev-descriptorpools using the numanode forwarded from hctx-numanode by its single caller, nvmeinithctxcommon. On a non-NUMA kernel...