CVE-2026-74315 lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()

In the Linux kernel, the following vulnerability has been resolved: lockd: Avoid hashing uninitialized bytes in nlm4svclookupfile filehash digests the first LOCKDFHHASHSIZE bytes of nfsfh.data when bucketing nlmfiles, independent of fh.size. Commit 3de744ee4e45 "lockd: Use xdrgen XDR functions fo...

CVE-2026-74315 lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()

In the Linux kernel, the following vulnerability has been resolved: lockd: Avoid hashing uninitialized bytes in nlm4svclookupfile filehash digests the first LOCKDFHHASHSIZE bytes of nfsfh.data when bucketing nlmfiles, independent of fh.size. Commit 3de744ee4e45 "lockd: Use xdrgen XDR functions fo...

CVE-2026-74315

In the Linux kernel, the following vulnerability has been resolved: lockd: Avoid hashing uninitialized bytes in nlm4svclookupfile filehash digests the first LOCKDFHHASHSIZE bytes of nfsfh.data when bucketing nlmfiles, independent of fh.size. Commit 3de744ee4e45 "lockd: Use xdrgen XDR functions fo...

EUVD-2026-59461

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpfobjfreefields when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete...

CVE-2026-74313 vduse: hold vduse_lock across IDR lookup in open path

In the Linux kernel, the following vulnerability has been resolved: vduse: hold vduselock across IDR lookup in open path vdusedevopen looks up struct vdusedev through the IDR and then acquires dev-lock only after vduselock has been dropped. This leaves a window where a concurrent VDUSEDESTROYDEV...

CVE-2026-74314 bpf: Cancel special fields on map value recycle

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpfobjfreefields when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete...

CVE-2026-74314 bpf: Cancel special fields on map value recycle

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpfobjfreefields when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete...

CVE-2026-74313

In the Linux kernel, the following vulnerability has been resolved: vduse: hold vduselock across IDR lookup in open path vdusedevopen looks up struct vdusedev through the IDR and then acquires dev-lock only after vduselock has been dropped. This leaves a window where a concurrent VDUSEDESTROYDEV...

EUVD-2026-59460

In the Linux kernel, the following vulnerability has been resolved: vduse: hold vduselock across IDR lookup in open path vdusedevopen looks up struct vdusedev through the IDR and then acquires dev-lock only after vduselock has been dropped. This leaves a window where a concurrent VDUSEDESTROYDEV...

CVE-2026-74313

The CVE-2026-74313 issue affects the Linux kernel under the VDUSE path. Specifically, vduse_dev_open() currently looks up a vduse_dev via an IDR lookup and then acquires dev->lock after vduse_lock is dropped, creating a window where VDUSE_DESTROY_DEV could remove and free the same object befor...

CVE-2026-74314

CVE-2026-74314 relates to the Linux kernel BPF map value handling. The description shows a fix for canceling field cleanup on map value recycle: during updates/deletes, fields no longer are eagerly freed via bpf_obj_free_fields(); instead, bpf_obj_cancel_fields() performs only NMI-safe cleanup fo...

CVE-2026-74313 vduse: hold vduse_lock across IDR lookup in open path

In the Linux kernel, the following vulnerability has been resolved: vduse: hold vduselock across IDR lookup in open path vdusedevopen looks up struct vdusedev through the IDR and then acquires dev-lock only after vduselock has been dropped. This leaves a window where a concurrent VDUSEDESTROYDEV...

CVE-2026-74314

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpfobjfreefields when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete...

CVE-2026-74312 vhost/vdpa: validate virtqueue index in mmap and fault paths

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: validate virtqueue index in mmap and fault paths vhostvdpammap and vhostvdpafault use vma-vmpgoff as a virtqueue index for getvqnotification, but they do not validate that the index is smaller than v-nvqs. The ioctl...

CVE-2026-74312

The CVE-2026-74312 entries describe a Linux kernel vulnerability in vhost/vdpa where mmap and fault paths use vma->vm_pgoff as a virtqueue index without proper bounds validation against v->nvqs. This allowed an out-of-range queue index to reach driver callbacks via get_vq_notification(), un...

EUVD-2026-59459

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: validate virtqueue index in mmap and fault paths vhostvdpammap and vhostvdpafault use vma-vmpgoff as a virtqueue index for getvqnotification, but they do not validate that the index is smaller than v-nvqs. The ioctl...

CVE-2026-74312 vhost/vdpa: validate virtqueue index in mmap and fault paths

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: validate virtqueue index in mmap and fault paths vhostvdpammap and vhostvdpafault use vma-vmpgoff as a virtqueue index for getvqnotification, but they do not validate that the index is smaller than v-nvqs. The ioctl...

CVE-2026-74312

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: validate virtqueue index in mmap and fault paths vhostvdpammap and vhostvdpafault use vma-vmpgoff as a virtqueue index for getvqnotification, but they do not validate that the index is smaller than v-nvqs. The ioctl...

CVE-2026-74311

CVE-2026-74311 affects the Linux kernel virtio rtc path. The bug occurs when viortc_restore() calls viortc_init_vqs() without removing old virtqueues, enabling vp_del_vqs() to reference a NULL info pointer in vp_del_vq() and crash the guest kernel during restore. The fix deletes stale virtqueues ...

CVE-2026-74311 virtio: rtc: tear down old virtqueues before restore

In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: tear down old virtqueues before restore virtiodevicerestore resets the device and restores the negotiated features before calling -restore. viortcfreeze intentionally leaves the existing virtqueues in place so the...