CVE-2026-74624

A deadlock vulnerability exists in the Linux kernel's netfilter nf_conntrack component. When TCP or SCTP conntrack paths emit invalid-packet logs while ct->lock is held, and logging is routed to nfnetlink_log with conntrack export enabled, the log path can re-enter conntrack netlink glue that ...

EUVD-2026-64561

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct-lock is still held. When invalid logging is routed to nfnetlinklog and conntrack export is enabled, t...

CVE-2026-74624 netfilter: nf_conntrack: defer invalid log until after unlock

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct-lock is still held. When invalid logging is routed to nfnetlinklog and conntrack export is enabled, t...

CVE-2026-74624 netfilter: nf_conntrack: defer invalid log until after unlock

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct-lock is still held. When invalid logging is routed to nfnetlinklog and conntrack export is enabled, t...

CVE-2026-74617 dibs: initialise dibs->lock in dibs_dev_alloc()

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs-lock in dibsdevalloc dibs-lock is initialised by dibsdevadd, but a dibs device can already take interrupts before that call: ismprobe runs ismdevinit, and hence requestirq, before it calls dibsdevadd. No...

CVE-2026-74617

CVE-2026-74617 affects the Linux kernel 's dibs device driver. The root cause is that dibs->lock was initialised in dibs_dev_add(), but a dibs device can already receive interrupts before that call: ism_probe() invokes ism_dev_init() (which calls request_irq()) prior to dibs_dev_add(). A GID e...

EUVD-2026-64554

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs-lock in dibsdevalloc dibs-lock is initialised by dibsdevadd, but a dibs device can already take interrupts before that call: ismprobe runs ismdevinit, and hence requestirq, before it calls dibsdevadd. No...

CVE-2026-74617 dibs: initialise dibs->lock in dibs_dev_alloc()

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs-lock in dibsdevalloc dibs-lock is initialised by dibsdevadd, but a dibs device can already take interrupts before that call: ismprobe runs ismdevinit, and hence requestirq, before it calls dibsdevadd. No...

CVE-2026-74614

A flaw in the Linux kernel's vsock/virtio driver allows a stale pointer to a deleted virtqueue to be retained by RX, TX, or event workers during suspend/resume cycles. The root cause is a lock ordering issue introduced by commit bd50c5dc182b (device suspend/resume support): workers read their vir...

CVE-2026-74609 tipc: read le->link under the node lock in tipc_node_link_down()

In the Linux kernel, the following vulnerability has been resolved: tipc: read le-link under the node lock in tipcnodelinkdown tipcnodelinkdown caches the link pointer before taking n-lock: struct tipclink l = le-link; / unlocked / if !l return; tipcnodewritelockn; if !tipclinkisestablishingl /...

EUVD-2026-64546

In the Linux kernel, the following vulnerability has been resolved: tipc: read le-link under the node lock in tipcnodelinkdown tipcnodelinkdown caches the link pointer before taking n-lock: struct tipclink l = le-link; / unlocked / if !l return; tipcnodewritelockn; if !tipclinkisestablishingl /...

CVE-2026-74609 tipc: read le->link under the node lock in tipc_node_link_down()

In the Linux kernel, the following vulnerability has been resolved: tipc: read le-link under the node lock in tipcnodelinkdown tipcnodelinkdown caches the link pointer before taking n-lock: struct tipclink l = le-link; / unlocked / if !l return; tipcnodewritelockn; if !tipclinkisestablishingl /...

CVE-2026-74607 KVM: SVM: Serialize accesses to the owner and mirror list with separate lock

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Interaction between KVMCAPVMMOVEENCCONTEXTFROM and KVMCAPVMCOPYENCCONTEXTFROM can cause two separate issues: - in sevmigratefrom, when the destination K...

CVE-2026-74607 KVM: SVM: Serialize accesses to the owner and mirror list with separate lock

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Interaction between KVMCAPVMMOVEENCCONTEXTFROM and KVMCAPVMCOPYENCCONTEXTFROM can cause two separate issues: - in sevmigratefrom, when the destination K...

CVE-2026-74607

A race condition in the Linux kernel's KVM SVM (Secure Virtual Machine) module affects the management of encrypted VM owner and mirror lists. When KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM interact concurrently, sev_migrate_from() can corrupt the owner's mirror list by...

CVE-2026-74599

CVE-2026-74599 is a race condition in the Linux kernel 's mm/ptdump subsystem. Previous fixes established that kernel page table freeing occurs while holding an mmap read lock on init_mm , but x86 and arm64 architectures can perform a ptdump over a non-init_mm via ptdump_walk_pgd(). Since kernel ...

CVE-2026-74599 mm/ptdump: always stabilise against page table freeing using init_mm

In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: always stabilise against page table freeing using initmm Previous commits have established the invariant that kernel page table freeing is performed while an mmap read lock on initmm is held, which fixes races between...

CVE-2026-74599 mm/ptdump: always stabilise against page table freeing using init_mm

In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: always stabilise against page table freeing using initmm Previous commits have established the invariant that kernel page table freeing is performed while an mmap read lock on initmm is held, which fixes races between...

EUVD-2026-64530

In the Linux kernel, the following vulnerability has been resolved: schedext: Take cgrouplock first in scxcgrouplock scxcgrouplock write-locks scxcgroupopsrwsem and then takes cgrouplock, which can deadlock through kernfs: scx enable/disable cgroup rmdir cpu.weight write ------------------...

CVE-2026-74593 sched_ext: Take cgroup_lock() first in scx_cgroup_lock()

In the Linux kernel, the following vulnerability has been resolved: schedext: Take cgrouplock first in scxcgrouplock scxcgrouplock write-locks scxcgroupopsrwsem and then takes cgrouplock, which can deadlock through kernfs: scx enable/disable cgroup rmdir cpu.weight write ------------------...