CVE-2026-74716

This vulnerability affects the Linux kernel in the accel/amdxdna driver. The root cause is in amdxdna_insert_pages(), where vm_flags_mod() sets VM_MIXEDMAP and clears VM_PFNMAP. An unprivileged local user can mmap a non-imported GEM object, call madvise(MADV_DONTNEED) to clear PTEs, then trigger ...

CVE-2026-74715 bpf: Fix netns reference imbalance in conntrack kfuncs

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...

CVE-2026-74716 accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix locally exploitable BUGON in amdxdnainsertpages In amdxdnainsertpages, vmflagsmod sets VMMIXEDMAP and clears VMPFNMAP. If an unprivileged userspace process mmaps a non-imported GEM object and then calls...

CVE-2026-74716

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix locally exploitable BUGON in amdxdnainsertpages In amdxdnainsertpages, vmflagsmod sets VMMIXEDMAP and clears VMPFNMAP. If an unprivileged userspace process mmaps a non-imported GEM object and then calls...

EUVD-2026-64403

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix locally exploitable BUGON in amdxdnainsertpages In amdxdnainsertpages, vmflagsmod sets VMMIXEDMAP and clears VMPFNMAP. If an unprivileged userspace process mmaps a non-imported GEM object and then calls...

CVE-2026-74715

This vulnerability affects the Linux kernel BPF conntrack kfuncs (__bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry()). The root cause is a race condition : the opts->netns_id field is read separately when acquiring and releasing the network namespace reference. Because opts can point to a shar...

EUVD-2026-64402

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...

CVE-2026-74713 vhost_iotlb: bound map allocation in add_range

In the Linux kernel, the following vulnerability has been resolved: vhostiotlb: bound map allocation in addrange vhostiotlbaddrangectx only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOSTIOTLBFLAGRETIRE set. Non-retiring tables can keep...

EUVD-2026-64400

In the Linux kernel, the following vulnerability has been resolved: vhostiotlb: bound map allocation in addrange vhostiotlbaddrangectx only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOSTIOTLBFLAGRETIRE set. Non-retiring tables can keep...

CVE-2026-74714

CVE-2026-74714 is a use-after-free in the Linux kernel's bpf_iter_tcp_established_batch() function. The root cause is a race condition: when a TCP request_sock is being published onto the ehash chain, its refcount is still zero until after the bucket lock is dropped. The BPF TCP iterator calls pl...

CVE-2026-74713

In the Linux kernel, the following vulnerability has been resolved: vhostiotlb: bound map allocation in addrange vhostiotlbaddrangectx only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOSTIOTLBFLAGRETIRE set. Non-retiring tables can keep...

CVE-2026-74714

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

CVE-2026-74714 bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

CVE-2026-74713

CVE-2026-74713 affects the Linux kernel vhost_iotlb subsystem. The root cause is that vhost_iotlb_add_range_ctx() only retires an old entry when the table has a non-zero limit, has exactly reached that limit, and has VHOST_IOTLB_FLAG_RETIRE set. Non-retiring tables can keep allocating entries aft...

EUVD-2026-64401

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

EUVD-2026-64399

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 mlx5core Read of size 272 at addr 0000000176795020 by task...

CVE-2026-74712

CVE-2026-74712 is a slab-out-of-bounds read in the Linux kernel mlx5_vdpa driver, specifically in the create_direct_keys() function. The root cause is a size calculation mismatch: the input buffer length passed to cmd_exec includes the full structure size (out + in + mtt[]), but the pointer point...

CVE-2026-74712

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 mlx5core Read of size 272 at addr 0000000176795020 by task...

CVE-2026-74712 vdpa/mlx5: Fix buffer length in create_direct_keys()

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 mlx5core Read of size 272 at addr 0000000176795020 by task...

CVE-2026-74711

CVE-2026-74711 is a type confusion vulnerability in the Linux kernel's hwmon pmbus driver (drivers/hwmon/pmbus/pmbus_core.c). In pmbus_notify(), the code unconditionally casts every attribute to struct sensor_device_attribute, but data->group.attrs may contain other types such as struct pmbus_...