CVE-2026-74523

Summary: CVE-2026-74523 affects the Linux kernel qede driver with VXLAN/GENEVE tunnels. A TX timeout can cause recovery deadlocks in the driver’s mutex, freezing rtnetlink control for the node. What’s affected: The qede UDP tunnel synchronization flow during recovery paths, where recovery nested ...

EUVD-2026-59716

In the Linux kernel, the following vulnerability has been resolved: qede: sync udptunnel ports outside qedelock in the recovery path A TX timeout on a qede NIC that has VXLAN/GENEVE tunnel ports configured wedges the rtnetlink control plane of the whole machine: NETDEV WATCHDOG: ens6f1 qede:...

CVE-2026-74523 qede: sync udp_tunnel ports outside qede_lock in the recovery path

In the Linux kernel, the following vulnerability has been resolved: qede: sync udptunnel ports outside qedelock in the recovery path A TX timeout on a qede NIC that has VXLAN/GENEVE tunnel ports configured wedges the rtnetlink control plane of the whole machine: NETDEV WATCHDOG: ens6f1 qede:...

CVE-2026-74521

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

EUVD-2026-59715

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode. ksmbdclosefd currently marks the file closed a...

CVE-2026-74522

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode. ksmbdclosefd currently marks the file closed a...

CVE-2026-74522 ksmbd: fix use-after-free in __close_file_table_ids()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode. ksmbdclosefd currently marks the file closed a...

CVE-2026-74522

The CVE-2026-74522 entry describes a Linux kernel ksmbd use-after-free in __close_file_table_ids(). A ksmbd_file can stay alive after logical close while another session holds a temporary reference, leading to a potential use-after-free when the final ksmbd_fd_put() path frees the object without ...

CVE-2026-74521

The CVE-2026-74521 vulnerability affects the Linux kernel’s ksmbd component, where ClientGUIDs were compared with strncmp() and could misclassify distinct GUIDs that contain embedded NUL bytes. The fix uses memcmp() to compare all SMB2_CLIENT_GUID_SIZE bytes in SMB3 multichannel session binding a...

EUVD-2026-59713

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopfgroupalloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufdfaultiopfhandler also queued an accepted group in the...

CVE-2026-74519

In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: don't free uninitialized devname on error path dtrememberorfreemap duplicates devname for each map entry. If kstrdupconst fails, dtfreemap frees devname in all nummaps entries, including entries that have not...

CVE-2026-74520 iommu/iommufd: Fix IOPF group ownership UAF

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopfgroupalloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufdfaultiopfhandler also queued an accepted group in the...

CVE-2026-74519 pinctrl: devicetree: don't free uninitialized dev_name on error path

In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: don't free uninitialized devname on error path dtrememberorfreemap duplicates devname for each map entry. If kstrdupconst fails, dtfreemap frees devname in all nummaps entries, including entries that have not...

CVE-2026-74520

The CVE-2026-74520 issue is in the Linux kernel’s iommu/iommufd path, where iopf_group_alloc() links the last-page IOPF group into the generic pending list and iommufd_fault_iopf_handler() queues an accepted group in the IOMMUFD deliver list without removing it from the generic list. When a devic...

CVE-2026-74520

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopfgroupalloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufdfaultiopfhandler also queued an accepted group in the...

CVE-2026-74519

In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: don't free uninitialized devname on error path dtrememberorfreemap duplicates devname for each map entry. If kstrdupconst fails, dtfreemap frees devname in all nummaps entries, including entries that have not...

EUVD-2026-59712

In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: don't free uninitialized devname on error path dtrememberorfreemap duplicates devname for each map entry. If kstrdupconst fails, dtfreemap frees devname in all nummaps entries, including entries that have not...

CVE-2026-74520 iommu/iommufd: Fix IOPF group ownership UAF

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopfgroupalloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufdfaultiopfhandler also queued an accepted group in the...

CVE-2026-74519 pinctrl: devicetree: don't free uninitialized dev_name on error path

In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: don't free uninitialized devname on error path dtrememberorfreemap duplicates devname for each map entry. If kstrdupconst fails, dtfreemap frees devname in all nummaps entries, including entries that have not...

CVE-2026-74519

CVE-2026-74519 describes a Linux kernel vulnerability in the pinctrl devicetree handling: dt_remember_or_free_map() may free uninitialized dev_name entries if kstrdup_const() fails, leading to a KASAN double-free during cleanup in dt_free_map. The issue arises when pinctrl drivers (e.g., pinctrl-...