CVE-2026-74370 liveupdate: fix TOCTOU race in luo_session_retrieve()

In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix TOCTOU race in luosessionretrieve Extend the scope of the rwsemread lock in luosessionretrieve to overlap with the acquisition of the session mutex. This prevents a concurrent thread from releasing and freeing the...

CVE-2026-74368

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12kwifi7dprxhverifytkipmic In ath12kwifi7dprxhverifytkipmic, the call to ath12kdprxchecknwifihdrlenvalid may return false when the NWIFI header length is invalid, causing the function to abort...

CVE-2026-74366

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in changestalinks for unready link ieee80211setactivelinks calls ieee80211linkusechannel for each newly-added link and WARNONONCEs if it fails. The call uses assignonfailure=true, which allows mac8021...

CVE-2026-74367

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix inconsistent arvif state in vdevcreate error paths ath12kmacvdevcreate has three error path issues that leave arvif in an inconsistent state: 1. When ath12kwmivdevcreate fails, the function returns directly...

CVE-2026-74365

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

CVE-2026-74363

The CVE-2026-74363 entry concerns a Linux kernel BPF/bpffs use-after-free related to inode cleanup. The root cause was that moved cleanup from ->free_inode() into ->destroy_inode() to avoid sleeping in RCU when calling bpf_any_put(), which inadvertently removed the RCU delay on freeing the ...

EUVD-2026-59510

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 "bpf: Avoid RCU context warning when unpinning htab with internal structs" moved inode cleanup from -freeinode into -destroyinode to avoid sleeping ...

CVE-2026-74363 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 "bpf: Avoid RCU context warning when unpinning htab with internal structs" moved inode cleanup from -freeinode into -destroyinode to avoid sleeping ...

CVE-2026-74363

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 "bpf: Avoid RCU context warning when unpinning htab with internal structs" moved inode cleanup from -freeinode into -destroyinode to avoid sleeping ...

CVE-2026-74364

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps as inner maps in map-in-map An exclusive map created with exclproghash is bound to a single program by hash: checkmapprogcompatibility refuses to load any program whose digest does not match...

CVE-2026-74362

In the Linux kernel, the following vulnerability has been resolved: ext2: fix ignored return value of genericwritesync Fix ext2diowriteiter to propagate the error returned by genericwritesync instead of silently discarding it, which could cause write2 to return success to userspace on OSYNC/ODSYN...

CVE-2026-74360

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps for bpfmapelem iterators Exclusive maps aka exclproghash are meant to be reachable only from the single program whose hash matches. This is enforced by checkmapprogcompatibility when the map is referenc...

CVE-2026-74361

In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used instead of =, incorrectly accepting fdpidx when it equals n i.e. NUMFDPC + 1...

CVE-2026-74359 configfs_lookup(): don't leave ->s_dentry dangling on failure

In the Linux kernel, the following vulnerability has been resolved: configfslookup: don't leave -sdentry dangling on failure Normally -sdentry is cleared when dentry it's pointing to becomes negative on eviction, realistically. However, that only happens if dentry gets to be positive in the first...

EUVD-2026-59506

In the Linux kernel, the following vulnerability has been resolved: configfslookup: don't leave -sdentry dangling on failure Normally -sdentry is cleared when dentry it's pointing to becomes negative on eviction, realistically. However, that only happens if dentry gets to be positive in the first...

CVE-2026-74359 configfs_lookup(): don't leave ->s_dentry dangling on failure

In the Linux kernel, the following vulnerability has been resolved: configfslookup: don't leave -sdentry dangling on failure Normally -sdentry is cleared when dentry it's pointing to becomes negative on eviction, realistically. However, that only happens if dentry gets to be positive in the first...

CVE-2026-74359

In CVE-2026-74359, the Linux kernel fixes a use-after-free in configfs_lookup where a dangling ->s_dentry can be observed after inode allocation failure. The root cause was that, on certain failure paths, the dentry’s link to a configfs_dirent wasn’t cleared, leaving a pointer in ->s_dentry...

CVE-2026-74359

In the Linux kernel, the following vulnerability has been resolved: configfslookup: don't leave -sdentry dangling on failure Normally -sdentry is cleared when dentry it's pointing to becomes negative on eviction, realistically. However, that only happens if dentry gets to be positive in the first...

CVE-2026-74358

In the Linux kernel, the following vulnerability has been resolved: ext4: fix fast commit wait/wake bit mapping on 64-bit On 64-bit, ext4 dynamic inode states live in the upper half of iflags, and ext4testinodestate applies the corresponding +32 offset. The fast-commit wait and wake paths...

CVE-2026-74357

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpucoredump ring dump The ring content dump in amdgpucoredump uses two separate loops over adev-rings: the first counts rings with unsignalled fences to size the allocation, and the...