CVE-2026-74351

CVE-2026-74351 affects the Linux kernel OCFS2 locking state. The root cause is a use-after-free risk where the debugfs iterator copies ocfs2_lock_res with a non-NULL sb_lvbptr that still points to an original lockres owner after teardown, leading to a freed container being accessed during dump. T...

CVE-2026-74351

In the Linux kernel, the following vulnerability has been resolved: ocfs2: rebase copied fsdlm LVB pointers in lockingstate The lockingstate debugfs iterator snapshots struct ocfs2lockres by value under ocfs2dlmtrackinglock and later formats that copy in ocfs2dlmseqshow. That is fine for the inli...

CVE-2026-74350 ocfs2: validate fast symlink target during inode read

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate fast symlink target during inode read ocfs2validateinodeblock already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same treatmen...

EUVD-2026-59498

In the Linux kernel, the following vulnerability has been resolved: ocfs2: rebase copied fsdlm LVB pointers in lockingstate The lockingstate debugfs iterator snapshots struct ocfs2lockres by value under ocfs2dlmtrackinglock and later formats that copy in ocfs2dlmseqshow. That is fine for the inli...

CVE-2026-74351 ocfs2: rebase copied fsdlm LVB pointers in locking_state

In the Linux kernel, the following vulnerability has been resolved: ocfs2: rebase copied fsdlm LVB pointers in lockingstate The lockingstate debugfs iterator snapshots struct ocfs2lockres by value under ocfs2dlmtrackinglock and later formats that copy in ocfs2dlmseqshow. That is fine for the inli...

CVE-2026-74349

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject FITRIM ranges shorter than a cluster ocfs2trimmainbm trims the global bitmap in cluster units, but its too-short range validation only checks sb-sblocksize. On filesystems with a cluster size larger than the block...

CVE-2026-74347

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nfcttimeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being used...

CVE-2026-74347 netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nfcttimeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being used...

CVE-2026-74347

This CVE concerns the Linux kernel netfilter cttimeout handling. The fix adds a refcount for struct nf_ct_timeout used by the ct extension to track whether a conntrack entry uses the custom timeout policy, and then removes the control-plane refcount so the timeout policy can be removed immediatel...

EUVD-2026-59495

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: require a ref for lockingstate debugfs open debuglockresopen copies inode-iprivate into struct debuglockres and debuglockresrelease later drops that pointer with dlmput. That only works if open successfully pins the...

CVE-2026-74348

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: require a ref for lockingstate debugfs open debuglockresopen copies inode-iprivate into struct debuglockres and debuglockresrelease later drops that pointer with dlmput. That only works if open successfully pins the...

CVE-2026-74348

CVE-2026-74348 affects the Linux kernel, specifically the ocfs2/dlm path for locking_state debugfs opens. The root cause is that debug_lockres_open() calls dlm_grab(dlm) but ignores its return value; after the last domain unregisters, dlm_grab() can return NULL, yet open stores the raw pointer an...

CVE-2026-74348 ocfs2/dlm: require a ref for locking_state debugfs open

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: require a ref for lockingstate debugfs open debuglockresopen copies inode-iprivate into struct debuglockres and debuglockresrelease later drops that pointer with dlmput. That only works if open successfully pins the...

CVE-2026-74347 netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nfcttimeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being used...

EUVD-2026-59494

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nfcttimeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being used...

CVE-2026-74348 ocfs2/dlm: require a ref for locking_state debugfs open

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: require a ref for lockingstate debugfs open debuglockresopen copies inode-iprivate into struct debuglockres and debuglockresrelease later drops that pointer with dlmput. That only works if open successfully pins the...

CVE-2026-74346

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev//patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating...

CVE-2026-74344 bpf: Clear rb node linkage when freeing bpf_rb_root

In the Linux kernel, the following vulnerability has been resolved: bpf: Clear rb node linkage when freeing bpfrbroot bpfrbrootfree detaches the root by copying the current rbrootcached and then replacing the live root with RBROOTCACHED. It then walks the copied root and drops each object contain...

CVE-2026-74345 RDMA/siw: Fix endpoint/socket association handling

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix endpoint/socket association handling Disassociating a socket from an endpoint via siwsocketdisassoc may release the last reference on that endpoint and free it. Therefore, don't clear the endpoints socket pointer...

CVE-2026-74344

CVE-2026-74344 affects the Linux kernel BPF RB-tree code. The vulnerability arises in bpf_rb_root_free() when detaching the root: the function copies rb_root_cached, replaces the live root with RB_ROOT_CACHED, and then walks the copied tree to drop objects. If a dropped object is refcounted and s...