379718 matches found
EUVD-2026-64404
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fwtracer, return NULL on create error Tracer creation can fail by returning either NULL or ERRPTR. The return value is stored without a check on the device, and users treat ERRPTR and NULL the same way. This also causes...
CVE-2026-74717
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fwtracer, return NULL on create error Tracer creation can fail by returning either NULL or ERRPTR. The return value is stored without a check on the device, and users treat ERRPTR and NULL the same way. This also causes...
CVE-2026-74715 bpf: Fix netns reference imbalance in conntrack kfuncs
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...
CVE-2026-74716
This vulnerability affects the Linux kernel in the accel/amdxdna driver. The root cause is in amdxdna_insert_pages(), where vm_flags_mod() sets VM_MIXEDMAP and clears VM_PFNMAP. An unprivileged local user can mmap a non-imported GEM object, call madvise(MADV_DONTNEED) to clear PTEs, then trigger ...
CVE-2026-74715
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...
CVE-2026-74715 bpf: Fix netns reference imbalance in conntrack kfuncs
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...
CVE-2026-74716 accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix locally exploitable BUGON in amdxdnainsertpages In amdxdnainsertpages, vmflagsmod sets VMMIXEDMAP and clears VMPFNMAP. If an unprivileged userspace process mmaps a non-imported GEM object and then calls...
CVE-2026-74716 accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix locally exploitable BUGON in amdxdnainsertpages In amdxdnainsertpages, vmflagsmod sets VMMIXEDMAP and clears VMPFNMAP. If an unprivileged userspace process mmaps a non-imported GEM object and then calls...
EUVD-2026-64403
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix locally exploitable BUGON in amdxdnainsertpages In amdxdnainsertpages, vmflagsmod sets VMMIXEDMAP and clears VMPFNMAP. If an unprivileged userspace process mmaps a non-imported GEM object and then calls...
CVE-2026-74715
CVE-2026-74715 is a race condition in the Linux kernel BPF conntrack kfuncs (__bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry()). The opts argument can reference a shared BPF map value, and opts->netns_id is read independently during namespace reference acquisition and release. A concurrent wr...
EUVD-2026-64402
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...
CVE-2026-74716
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix locally exploitable BUGON in amdxdnainsertpages In amdxdnainsertpages, vmflagsmod sets VMMIXEDMAP and clears VMPFNMAP. If an unprivileged userspace process mmaps a non-imported GEM object and then calls...
CVE-2026-74713 vhost_iotlb: bound map allocation in add_range
In the Linux kernel, the following vulnerability has been resolved: vhostiotlb: bound map allocation in addrange vhostiotlbaddrangectx only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOSTIOTLBFLAGRETIRE set. Non-retiring tables can keep...
EUVD-2026-64400
In the Linux kernel, the following vulnerability has been resolved: vhostiotlb: bound map allocation in addrange vhostiotlbaddrangectx only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOSTIOTLBFLAGRETIRE set. Non-retiring tables can keep...
CVE-2026-74713 vhost_iotlb: bound map allocation in add_range
In the Linux kernel, the following vulnerability has been resolved: vhostiotlb: bound map allocation in addrange vhostiotlbaddrangectx only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOSTIOTLBFLAGRETIRE set. Non-retiring tables can keep...
CVE-2026-74714
A use-after-free vulnerability in the Linux kernel BPF TCP iterator, specifically in bpf_iter_tcp_established_batch(). The root cause is a race condition: sock_hold() increments the reference count of a request_sock whose rsk_refcnt is still zero at publish time, and the subsequent refcount_set(3...
CVE-2026-74713
In the Linux kernel, the following vulnerability has been resolved: vhostiotlb: bound map allocation in addrange vhostiotlbaddrangectx only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOSTIOTLBFLAGRETIRE set. Non-retiring tables can keep...
CVE-2026-74714
In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...
CVE-2026-74714 bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...
CVE-2026-74713
A flaw in the Linux kernel's vhost_iotlb module allows non-retiring IOTLB tables to continue allocating entries beyond their configured limit (default 2048 for vhost devices). A local attacker or a malicious guest operating system can trigger a continuous stream of IOTLB updates, causing unbounde...