CVE-2026-74691

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Tear down DMA paths before stopping the rings tbnetteardown stops both rings and frees their frame buffers before calling tbxdomaindisablepaths. tbringstop zeroes the ring's descriptor base and tbnetfreebuffers...

CVE-2026-74692

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This opens a window where smccloseactive can...

CVE-2026-74690

In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ismdevexit A ism interrupt handler can be active in parallel with ismdevexit, accessing freed data structures. No new interrupts will be generated after unregisterieq. Drain ongoing interru...

CVE-2026-74694

In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSICMDSENDCMD payload length ncsisendcmdnl takes the number of bytes to copy from the attacker-controlled ncsipkthdr.length field of the in-band packet header, while the source buffer is the...

CVE-2026-74683

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdevgetmaskcnt and client evmasks array i...

CVE-2026-74680

In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: properly kill rcvurb on error in cxacrucm If cxacrucm encounters an error while submitting or waiting for sndurb, it aborts and returns the error without killing the already submitted rcvurb. This leaves the...

CVE-2026-74686

In the Linux kernel, the following vulnerability has been resolved: rqspinlock: Reset tail when preserving queue on deadlock Currently, the destruction of the waiter queue is suppressed for rqspinlock in cases where a deadlock is detected. Deadlock checks happen relatively frequently on entry for...

CVE-2026-74685

In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Clamp negative current limits When a negative value is passed to ltc4282writecurr, the signed long val is cast directly to u64: drivers/hwmon/ltc4282.c:ltc4282writecurr / need to pass it in millivolt / u32 in =...

CVE-2026-74682

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; if fmt-fmttype ==...

CVE-2026-74681

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it against txbuflen — the bulk OUT endpoint size. Both are taken independent...

CVE-2026-74679

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...

CVE-2026-74684

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

CVE-2026-74672

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire initmm lock on huge vmap to avoid ptdump UAF Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable freeing", v6. Kernel page table walkers fall into two broad categories - those ranges where...

CVE-2026-74674

In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zappterange reclaims a page table, it does: ptefreetlbtlb, pmdpgtablepmdval, addr; and this is unconditionally wrong: if this code executes, addr always points one...

CVE-2026-74676

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...

CVE-2026-74677

In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrierwork UAF on disconnect iphethsndbulkcallback re-arms the carrier-check work on any non-zero URB status: else scheduledelayedwork&dev-carrierwork, 0; Nothing ties that to the interface being up, so the...

CVE-2026-74675

In the Linux kernel, the following vulnerability has been resolved: vt: stabilize tty reference in kbdkeycode with ttyportttyget kbdkeycode reads vc-port.tty without acquiring a tty reference, racing against conshutdown which clears port.tty under a different lock. Use ttyportttyget/ttykrefput to...

CVE-2026-74671

In the Linux kernel, the following vulnerability has been resolved: ima: fix out-of-bounds read in xattrverify The digest-length check in xattrverify mixes int and sizet: if xattrlen - sizeofxattrvalue-type - hashstart = iint-imahash-length sizeof yields sizet, so the usual arithmetic conversions...

CVE-2026-74673

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - fix information leak in evdevpassvalues In evdevpassvalues, the inputevent structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. On architectures where...

CVE-2026-74678

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179178a: fix skb leak in ax88179txfixup When the interface has NETIFFSG enabled and skblinearize fails in ax88179txfixup, the function returns NULL without freeing the skb. usbnetstartxmit treats a NULL return from...