CVE-2026-74285

CVE-2026-74285 describes a Linux kernel issue where netif_rxq_cleanup_unlease() tear-down inverted the sequence: it uninstalls the memory provider (clearing dma_addr) before stopping the physical RX queue, allowing a window for DMA to stale/zero addresses via an active queue. The fix swaps the or...

CVE-2026-74285 net: Stop leased rxq before uninstalling its memory provider

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netifrxqcleanupunlease tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA...

CVE-2026-74284

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: Don't make class passive twice updatevf is called from two places for the same class during a single dequeue when the class's child qdisc e.g. codel/fqcodel drops its last packets while dequeuing: 1. The child...

CVE-2026-74283 tipc: require net admin for TIPCv2 netlink mutators

In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAPNETADMIN when an operation sets GENLADMINPERM or...

CVE-2026-74283 tipc: require net admin for TIPCv2 netlink mutators

In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAPNETADMIN when an operation sets GENLADMINPERM or...

CVE-2026-74283

The CVE covers the Linux kernel TIPCv2 netlink mutators, which earlier registered mutating generic-netlink operations without admin permission flags. The documented root cause is that generic-netlink checks for CAP_NET_ADMIN only when GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM are set; unprivileged l...

CVE-2026-74282

In the Linux kernel vulnerability CVE-2026-74282, the TIPC stack allows an oversized CONN_ACK to cause snt_unacked to underflow. The root cause is tipc_sk_conn_proto_rcv() subtracting the peer-supplied ack count from an unsigned 16-bit snt_unacked without ensuring it does not exceed the outstandi...

EUVD-2026-59429

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent sntunacked underflow on CONNACK tipcskconnprotorcv subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter sntunacked without checking that it does not exceed the number of messages...

CVE-2026-74282 tipc: prevent snt_unacked underflow on CONN_ACK

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent sntunacked underflow on CONNACK tipcskconnprotorcv subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter sntunacked without checking that it does not exceed the number of messages...

CVE-2026-74282

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent sntunacked underflow on CONNACK tipcskconnprotorcv subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter sntunacked without checking that it does not exceed the number of messages...

CVE-2026-74282 tipc: prevent snt_unacked underflow on CONN_ACK

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent sntunacked underflow on CONNACK tipcskconnprotorcv subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter sntunacked without checking that it does not exceed the number of messages...

EUVD-2026-59430

In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAPNETADMIN when an operation sets GENLADMINPERM or...

CVE-2026-74283

In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAPNETADMIN when an operation sets GENLADMINPERM or...

EUVD-2026-59428

In the Linux kernel, the following vulnerability has been resolved: tipc: reject inverted service ranges from peer bindings tipcupdatenametbl inserts a binding advertised by a peer node using the lower and upper service-range bounds taken directly from the wire, without checking that lower upper ...

CVE-2026-74281

CVE-2026-74281 — Linux kernel TIPC inverted service ranges : The vulnerability occurs in tipc_update_nametbl() where a peer’s binding uses lower/upper bounds from the wire without ensuring lower upper to be inserted into the service-range RB-tree in a way that cannot be matched or withdrawn. Thi...

CVE-2026-74281 tipc: reject inverted service ranges from peer bindings

In the Linux kernel, the following vulnerability has been resolved: tipc: reject inverted service ranges from peer bindings tipcupdatenametbl inserts a binding advertised by a peer node using the lower and upper service-range bounds taken directly from the wire, without checking that lower upper ...

CVE-2026-74281

In the Linux kernel, the following vulnerability has been resolved: tipc: reject inverted service ranges from peer bindings tipcupdatenametbl inserts a binding advertised by a peer node using the lower and upper service-range bounds taken directly from the wire, without checking that lower upper ...

EUVD-2026-59426

In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sgcleanup error path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

EUVD-2026-59427

In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sgcleanup path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

CVE-2026-74280 crypto: marvell/octeontx - fix DMA cleanup using wrong loop index

In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sgcleanup path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...