CVE-2026-74406

The CVE-2026-74406 entry relates to the Linux kernel, fixing a potential null-ptr-deref in vxlan_gro_prepare_receive() where udp_tunnel_sock_release() could clear sk->sk_user_data during execution. The issue involves a race with skb_gro_remcsum_init() and rcu_dereference_sk_user_data(). Affect...

CVE-2026-74406 vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...

CVE-2026-74403

The CVE-2026-74403 entries describe a Linux kernel fix in crypto: ccp where a NULL page allocation could lead to a non-NULL garbage from page_address(NULL) on architectures without HASHED_PAGE_VIRTUAL. The root cause is passing a potentially NULL page pointer to page_address() and then evaluating...

EUVD-2026-59550

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Check for page allocation failure correctly in TIO Sashiko notes: if snpallocfirmwarepages returns NULL under memory pressure, is it safe to pass it directly to pageaddress? On architectures without HASHEDPAGEVIRTUA...

CVE-2026-74403 crypto: ccp - Check for page allocation failure correctly in TIO

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Check for page allocation failure correctly in TIO Sashiko notes: if snpallocfirmwarepages returns NULL under memory pressure, is it safe to pass it directly to pageaddress? On architectures without HASHEDPAGEVIRTUA...

CVE-2026-74403 crypto: ccp - Check for page allocation failure correctly in TIO

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Check for page allocation failure correctly in TIO Sashiko notes: if snpallocfirmwarepages returns NULL under memory pressure, is it safe to pass it directly to pageaddress? On architectures without HASHEDPAGEVIRTUA...

CVE-2026-74400 bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries

In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpfset|removedentryxattr for negative dentries bpfsetdentryxattr and bpfremovedentryxattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passe...

CVE-2026-74400 bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries

In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpfset|removedentryxattr for negative dentries bpfsetdentryxattr and bpfremovedentryxattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passe...

EUVD-2026-59547

In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpfset|removedentryxattr for negative dentries bpfsetdentryxattr and bpfremovedentryxattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passe...

CVE-2026-74400

CVE-2026-74400 affects the Linux kernel: bpf_set_dentry_xattr and bpf_remove_dentry_xattr kfuncs may crash when given negative dentries because d_inode(dentry) can be NULL, leading to inode_lock(NULL). The fix adds a NULL check for the inode and returns -EINVAL when NULL. The patch also removes a...

EUVD-2026-59526

In the Linux kernel, the following vulnerability has been resolved: dax/kmem: account for partial discontiguous resource upon removal When devdaxkmemprobe partially succeeds at least one range is mapped but a subsequent range fails requestmemregion or addmemorydrivermanaged, the probe silently...

CVE-2026-74379

In the Linux kernel, the following vulnerability has been resolved: dax/kmem: account for partial discontiguous resource upon removal When devdaxkmemprobe partially succeeds at least one range is mapped but a subsequent range fails requestmemregion or addmemorydrivermanaged, the probe silently...

CVE-2026-74379 dax/kmem: account for partial discontiguous resource upon removal

In the Linux kernel, the following vulnerability has been resolved: dax/kmem: account for partial discontiguous resource upon removal When devdaxkmemprobe partially succeeds at least one range is mapped but a subsequent range fails requestmemregion or addmemorydrivermanaged, the probe silently...

CVE-2026-74379

CVE-2026-74379 affects the Linux kernel dax/kmem driver. The root cause is a partial success in dev_dax_kmem_probe() where at least one resource range is mapped but a subsequent range fails, leading to the range resource being NULL and the probe reporting success. Consequently, dev_dax_kmem_remov...

CVE-2026-74379 dax/kmem: account for partial discontiguous resource upon removal

In the Linux kernel, the following vulnerability has been resolved: dax/kmem: account for partial discontiguous resource upon removal When devdaxkmemprobe partially succeeds at least one range is mapped but a subsequent range fails requestmemregion or addmemorydrivermanaged, the probe silently...

CVE-2026-74366 wifi: ath12k: fix NULL deref in change_sta_links for unready link

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in changestalinks for unready link ieee80211setactivelinks calls ieee80211linkusechannel for each newly-added link and WARNONONCEs if it fails. The call uses assignonfailure=true, which allows mac8021...

CVE-2026-74366

CVE-2026-74366 concerns a NULL dereference in the Linux kernel’s ath12k wifi driver when handling unready links. The issue occurs because a path that validates a MAC channel may not create the vdev, leaving arvif->is_created as false and arvif->ar NULL. Subsequent code paths allocate an ars...

CVE-2026-74359

In the Linux kernel, the following vulnerability has been resolved: configfslookup: don't leave -sdentry dangling on failure Normally -sdentry is cleared when dentry it's pointing to becomes negative on eviction, realistically. However, that only happens if dentry gets to be positive in the first...

CVE-2026-74342 kernfs: link kn to its parent before the LSM init hook

In the Linux kernel, the following vulnerability has been resolved: kernfs: link kn to its parent before the LSM init hook After commit 12e9e3cd03b5 "simpexattr: use per-sb cache", kernfsxattrset and kernfsxattrget compute the cache via kernfsrootkn before any other check. kernfsrootkn walks...

CVE-2026-74342

The CVE-2026-74342 entries describe a Linux kernel issue in kernfs where the LSM security hook runs before kn->__parent and kn->dir.root are initialized, causing a NULL-pointer dereference in kernfs_root(kn) (triggered during the first cgroup mkdir under /sys/fs/cgroup on SELinux-enabled sy...