CVE-2026-74656

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fibnhcupdatemtu fibnhcupdatemtu walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcudereferenceprotected with a constant tr...

CVE-2026-74656 ipv4: fix use-after-free in fib_nhc_update_mtu()

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fibnhcupdatemtu fibnhcupdatemtu walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcudereferenceprotected with a constant tr...

EUVD-2026-64593

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fibnhcupdatemtu fibnhcupdatemtu walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcudereferenceprotected with a constant tr...

CVE-2026-74656 ipv4: fix use-after-free in fib_nhc_update_mtu()

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fibnhcupdatemtu fibnhcupdatemtu walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcudereferenceprotected with a constant tr...

CVE-2026-74656

A use-after-free vulnerability exists in the Linux kernel's IPv4 networking stack, specifically in the fib_nhc_update_mtu() function. The root cause is a race condition : this function walks the nexthop exception table under RTNL, but RTNL does not serialize the walk with concurrent PMTU exceptio...

EUVD-2026-64591

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

CVE-2026-74655

CVE-2026-74655 is a Denial of Service flaw in the Linux kernel's qcom-geni UART driver (DMA-mode). The root cause is a missing flush_buffer callback in the DMA-mode uart_ops: when TCOFLUSH is issued during an in-flight TX DMA transfer, the transfer can complete after the serial core resets the tr...

CVE-2026-74655

In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: fix TX DMA buffer flush When transmit flushing a qcom-geni UART during an ongoing TX DMA, the UART gets stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uartops does not provide a flushbuffer...

CVE-2026-74654

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

CVE-2026-74655 serial: qcom-geni: fix TX DMA buffer flush

In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: fix TX DMA buffer flush When transmit flushing a qcom-geni UART during an ongoing TX DMA, the UART gets stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uartops does not provide a flushbuffer...

CVE-2026-74654

This Linux kernel vulnerability affects the serial 8250 DMA driver . When a serial port is closed while an RX DMA transfer is active, serial8250_release_dma() leaves the rx_running flag set. On subsequent reopen, the DesignWare BUSY workaround calls serial8250_rx_dma_flush() before a new RX chann...

CVE-2026-74654 serial: 8250_dma: Clear stale RX state on shutdown

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

CVE-2026-74654 serial: 8250_dma: Clear stale RX state on shutdown

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

EUVD-2026-64592

In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: fix TX DMA buffer flush When transmit flushing a qcom-geni UART during an ongoing TX DMA, the UART gets stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uartops does not provide a flushbuffer...

CVE-2026-74655 serial: qcom-geni: fix TX DMA buffer flush

In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: fix TX DMA buffer flush When transmit flushing a qcom-geni UART during an ongoing TX DMA, the UART gets stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uartops does not provide a flushbuffer...

CVE-2026-74653 serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx

In the Linux kernel, the following vulnerability has been resolved: serial: 8250of: clear stuck empty-FIFO RX-timeout on LPC32xx The NXP LPC32xx UART PORTLPC3220 can latch an RX character-timeout interrupt while the RX FIFO is empty: IIR reports UARTIIRRXTIMEOUT 0x0c but LSR.DR is clear. A...

CVE-2026-74653 serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx

In the Linux kernel, the following vulnerability has been resolved: serial: 8250of: clear stuck empty-FIFO RX-timeout on LPC32xx The NXP LPC32xx UART PORTLPC3220 can latch an RX character-timeout interrupt while the RX FIFO is empty: IIR reports UARTIIRRXTIMEOUT 0x0c but LSR.DR is clear. A...

EUVD-2026-64590

In the Linux kernel, the following vulnerability has been resolved: serial: 8250of: clear stuck empty-FIFO RX-timeout on LPC32xx The NXP LPC32xx UART PORTLPC3220 can latch an RX character-timeout interrupt while the RX FIFO is empty: IIR reports UARTIIRRXTIMEOUT 0x0c but LSR.DR is clear. A...

CVE-2026-74653

In the Linux kernel, the following vulnerability has been resolved: serial: 8250of: clear stuck empty-FIFO RX-timeout on LPC32xx The NXP LPC32xx UART PORTLPC3220 can latch an RX character-timeout interrupt while the RX FIFO is empty: IIR reports UARTIIRRXTIMEOUT 0x0c but LSR.DR is clear. A...

CVE-2026-74653

CVE-2026-74653 affects the Linux kernel 8250_of serial driver on NXP LPC32xx (PORT_LPC3220) hardware. The UART can latch an RX character-timeout interrupt while the RX FIFO is empty; because the interrupt is level-triggered and re-fires immediately, it causes an interrupt storm that livelocks the...