CVE-2026-74645

In the Linux kernel, the following vulnerability has been resolved: mm/damon/lrusort: error out for 10000 activemembp damosquotascore can trigger division by zero if the target value is zero. DAMONLRUSORT lets users set the target value for the hot memory scheme via activemembp parameter. It avoi...

CVE-2026-74706

In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocation of auxrdev fails during auxiliary device setup, the error path calls auxiliarydeviceuninit, which eventually invokes bngeauxdevrelease. The release callback...

CVE-2026-74681

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it against txbuflen — the bulk OUT endpoint size. Both are taken independent...

CVE-2026-74709

In the Linux kernel, the following vulnerability has been resolved: xsk: clear metadata pointer when no timestamp is requested User space can change metadata flags after request processing. Rereading them during completion can therefore make the kernel write a timestamp that was not requested whe...

UBUNTU-CVE-2026-74600

In the Linux kernel, the following vulnerability has been resolved: mm/pagetablecheck: skip special zero mappings pagetablecheckset and pagetablecheckclear account mappings based on PageAnon. Shared zero-page PTEs and huge zero PMDs are special mappings, but pagetablecheck can still account them ...

UBUNTU-CVE-2026-74681

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it against txbuflen — the bulk OUT endpoint size. Both are taken independent...

UBUNTU-CVE-2026-74596

In the Linux kernel, the following vulnerability has been resolved: fs,fsverity: remove check for fsverity being enabled in setattrprepare The check that fs-verity is available in the kernel is not necessary here. Filesystems could have fsverity files even without fs-verity enabled. In that case,...

CVE-2026-74731

In the Linux kernel, the following vulnerability has been resolved: schedext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scxlinksched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs th...

CVE-2026-74718

In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlinknlreloaddoit calls devlinknetnsget, which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not...

CVE-2026-74715

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...

CVE-2026-74705

In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation skbudptunnelsegment gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb-head, the saved UDP header pointer is no longer...

CVE-2026-74704

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcake: drop WARNON1 for malformed packets in ACK filter The schcake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARNON1 which can...

CVE-2026-74689

In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vccsetsockopt vccsetsockopt contained an ineffective optlen check: if SOLEVELMATCHoptname, level && optlen != SOSIZEoptname return -EINVAL; If SOLEVELMATCHoptname, level evaluated to false...

CVE-2026-74690

In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ismdevexit A ism interrupt handler can be active in parallel with ismdevexit, accessing freed data structures. No new interrupts will be generated after unregisterieq. Drain ongoing interru...

CVE-2026-74687

In the Linux kernel, the following vulnerability has been resolved: watchdog: at91sam9wdt: prevent timer rearm during teardown at91ping rearms the watchdog timer from its callback. timerdelete neither waits for a running callback nor prevents it from rearming the timer, so probe failure or driver...

CVE-2026-74671

In the Linux kernel, the following vulnerability has been resolved: ima: fix out-of-bounds read in xattrverify The digest-length check in xattrverify mixes int and sizet: if xattrlen - sizeofxattrvalue-type - hashstart = iint-imahash-length sizeof yields sizet, so the usual arithmetic conversions...

CVE-2026-74667

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

CVE-2026-74663

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject overly deep qdisc hierarchies Deep qdisc hierarchies can lead to excessive recursion in qdisc tree walkers and exhaust the kernel stack. The existing loop check does not cover the create-and-graft path, so a...

CVE-2026-74656

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fibnhcupdatemtu fibnhcupdatemtu walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcudereferenceprotected with a constant tr...

CVE-2026-74654

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...