EUVD-2026-64400

In the Linux kernel, the following vulnerability has been resolved: vhostiotlb: bound map allocation in addrange vhostiotlbaddrangectx only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOSTIOTLBFLAGRETIRE set. Non-retiring tables can keep...

CVE-2026-74713

In the Linux kernel, the following vulnerability has been resolved: vhostiotlb: bound map allocation in addrange vhostiotlbaddrangectx only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOSTIOTLBFLAGRETIRE set. Non-retiring tables can keep...

CVE-2026-74714

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

CVE-2026-74714 bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

CVE-2026-74714

CVE-2026-74714 is a use-after-free in the Linux kernel's bpf_iter_tcp_established_batch() function. The root cause is a race condition: when a TCP request_sock is being published onto the ehash chain, its refcount is still zero until after the bucket lock is dropped. The BPF TCP iterator calls pl...

CVE-2026-74713

CVE-2026-74713 affects the Linux kernel vhost_iotlb subsystem. The root cause is that vhost_iotlb_add_range_ctx() only retires an old entry when the table has a non-zero limit, has exactly reached that limit, and has VHOST_IOTLB_FLAG_RETIRE set. Non-retiring tables can keep allocating entries aft...

CVE-2026-74714 bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

EUVD-2026-64401

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

EUVD-2026-64399

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 mlx5core Read of size 272 at addr 0000000176795020 by task...

CVE-2026-74712

CVE-2026-74712 is a slab-out-of-bounds read in the Linux kernel mlx5_vdpa driver, specifically in the create_direct_keys() function. The root cause is a size calculation mismatch: the input buffer length passed to cmd_exec includes the full structure size (out + in + mtt[]), but the pointer point...

CVE-2026-74712 vdpa/mlx5: Fix buffer length in create_direct_keys()

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 mlx5core Read of size 272 at addr 0000000176795020 by task...

CVE-2026-74712 vdpa/mlx5: Fix buffer length in create_direct_keys()

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 mlx5core Read of size 272 at addr 0000000176795020 by task...

CVE-2026-74712

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 mlx5core Read of size 272 at addr 0000000176795020 by task...

CVE-2026-74711 hwmon: (pmbus) Fix type confusion in notification logic

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbusnotify, the code unconditionally casts every attribute to a struct sensordeviceattribute:...

CVE-2026-74710

CVE-2026-74710 is a vulnerability in the Linux kernel's AF_XDP (xsk) subsystem . The kernel accepted a TX metadata length as small as 8 bytes , but every supported request requires flags plus at least one 8-byte request field. This insufficient validation allowed the kernel to read beyond the reg...

CVE-2026-74710 xsk: require at least 16 bytes of TX metadata

In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AFXDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the...

EUVD-2026-64397

In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AFXDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the...

CVE-2026-74711

CVE-2026-74711 is a type confusion vulnerability in the Linux kernel's hwmon pmbus driver (drivers/hwmon/pmbus/pmbus_core.c). In pmbus_notify(), the code unconditionally casts every attribute to struct sensor_device_attribute, but data->group.attrs may contain other types such as struct pmbus_...

EUVD-2026-64398

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbusnotify, the code unconditionally casts every attribute to a struct sensordeviceattribute:...

CVE-2026-74711 hwmon: (pmbus) Fix type confusion in notification logic

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbusnotify, the code unconditionally casts every attribute to a struct sensordeviceattribute:...