CVE-2026-74638 drm/v3d: Serialize the scheduler timeout handlers

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Serialize the scheduler timeout handlers V3D exposes several independent hardware queues BIN, RENDER, TFU and CSD but has only a single, global reset. A timeout on any one queue therefore has to stop, reset and restart t...

CVE-2026-74637 perf/core: Fix group leader use-after-free after sibling detach

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach perfgroupdetach handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their groupleader...

CVE-2026-74637 perf/core: Fix group leader use-after-free after sibling detach

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach perfgroupdetach handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their groupleader...

EUVD-2026-64573

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between updateeventfields and, eventdefinefields The following sequence may leads race between eventdefinefields and updateeventfields: CPU0 loads module A CPU1 loads module B ===============================...

CVE-2026-74636 tracing: Fix race between update_event_fields and, event_define_fields

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between updateeventfields and, eventdefinefields The following sequence may leads race between eventdefinefields and updateeventfields: CPU0 loads module A CPU1 loads module B ===============================...

CVE-2026-74636

CVE-2026-74636 is a race condition in the Linux kernel tracing subsystem. When two modules are loaded concurrently on different CPUs, event_define_fields() and update_event_fields() can access class->fields simultaneously without proper mutual exclusion. Specifically, trace_event_update_all() ...

CVE-2026-74636 tracing: Fix race between update_event_fields and, event_define_fields

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between updateeventfields and, eventdefinefields The following sequence may leads race between eventdefinefields and updateeventfields: CPU0 loads module A CPU1 loads module B ===============================...

EUVD-2026-64574

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach perfgroupdetach handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their groupleader...

CVE-2026-74636

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between updateeventfields and, eventdefinefields The following sequence may leads race between eventdefinefields and updateeventfields: CPU0 loads module A CPU1 loads module B ===============================...

CVE-2026-74637

CVE-2026-74637 is a use-after-free in the Linux kernel's perf subsystem . When a perf event group sibling is detached during CPU hotplug (DETACH_GROUP), it is removed from the leader's sibling list but its group_leader pointer is left stale. If the leader is later freed, a PERF_IOC_FLAG_GROUP ioc...

CVE-2026-74637

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach perfgroupdetach handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their groupleader...

EUVD-2026-64572

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

CVE-2026-74635 fbdev: bitblit: bound-check glyph index in bit_cursor()

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

CVE-2026-74635

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

CVE-2026-74635

CVE-2026-74635 is an out-of-bounds read in the Linux kernel's fbdev subsystem, specifically in bit_cursor() (drivers/video/fbdev/core/bitblit.c). The function indexes font glyph data using a value from the screen buffer without bounds-checking it against the font's glyph count. A local user can t...

CVE-2026-74635 fbdev: bitblit: bound-check glyph index in bit_cursor()

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

CVE-2026-74634

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ringbuffersubbuforderset frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rbadvanceite...

CVE-2026-74634

This vulnerability affects the Linux kernel ring-buffer subsystem. The root cause is that ring_buffer_subbuf_order_set() frees buffer pages even when resizing is disabled, leaving a non-consuming reader exposed to a use-after-free in rb_advance_iter(). The fix returns -EBUSY on resize_disabled, m...

EUVD-2026-64571

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ringbuffersubbuforderset frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rbadvanceite...

CVE-2026-74634 ring-buffer: Prevent subbuf order change when resizing is disabled

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ringbuffersubbuforderset frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rbadvanceite...