CVE-2026-74407 wifi: ath11k: cancel SSR work items during PCI shutdown

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery SSR. The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed...

CVE-2026-74407 wifi: ath11k: cancel SSR work items during PCI shutdown

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery SSR. The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed...

CVE-2026-74406 vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...

CVE-2026-74406

The CVE-2026-74406 entry relates to the Linux kernel, fixing a potential null-ptr-deref in vxlan_gro_prepare_receive() where udp_tunnel_sock_release() could clear sk->sk_user_data during execution. The issue involves a race with skb_gro_remcsum_init() and rcu_dereference_sk_user_data(). Affect...

EUVD-2026-59553

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...

CVE-2026-74406 vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...

CVE-2026-74403 crypto: ccp - Check for page allocation failure correctly in TIO

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Check for page allocation failure correctly in TIO Sashiko notes: if snpallocfirmwarepages returns NULL under memory pressure, is it safe to pass it directly to pageaddress? On architectures without HASHEDPAGEVIRTUA...

CVE-2026-74403 crypto: ccp - Check for page allocation failure correctly in TIO

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Check for page allocation failure correctly in TIO Sashiko notes: if snpallocfirmwarepages returns NULL under memory pressure, is it safe to pass it directly to pageaddress? On architectures without HASHEDPAGEVIRTUA...

CVE-2026-74400

In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpfset|removedentryxattr for negative dentries bpfsetdentryxattr and bpfremovedentryxattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passe...

CVE-2026-74400

CVE-2026-74400 affects the Linux kernel: bpf_set_dentry_xattr and bpf_remove_dentry_xattr kfuncs may crash when given negative dentries because d_inode(dentry) can be NULL, leading to inode_lock(NULL). The fix adds a NULL check for the inode and returns -EINVAL when NULL. The patch also removes a...

EUVD-2026-59547

In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpfset|removedentryxattr for negative dentries bpfsetdentryxattr and bpfremovedentryxattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passe...

CVE-2026-74400 bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries

In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpfset|removedentryxattr for negative dentries bpfsetdentryxattr and bpfremovedentryxattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passe...

CVE-2026-74400 bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries

In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpfset|removedentryxattr for negative dentries bpfsetdentryxattr and bpfremovedentryxattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passe...

CVE-2026-74387

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...

CVE-2026-74379

CVE-2026-74379 affects the Linux kernel dax/kmem driver. The root cause is a partial success in dev_dax_kmem_probe() where at least one resource range is mapped but a subsequent range fails, leading to the range resource being NULL and the probe reporting success. Consequently, dev_dax_kmem_remov...

CVE-2026-74379 dax/kmem: account for partial discontiguous resource upon removal

In the Linux kernel, the following vulnerability has been resolved: dax/kmem: account for partial discontiguous resource upon removal When devdaxkmemprobe partially succeeds at least one range is mapped but a subsequent range fails requestmemregion or addmemorydrivermanaged, the probe silently...

CVE-2026-74379

In the Linux kernel, the following vulnerability has been resolved: dax/kmem: account for partial discontiguous resource upon removal When devdaxkmemprobe partially succeeds at least one range is mapped but a subsequent range fails requestmemregion or addmemorydrivermanaged, the probe silently...

CVE-2026-74366

CVE-2026-74366 concerns a NULL dereference in the Linux kernel’s ath12k wifi driver when handling unready links. The issue occurs because a path that validates a MAC channel may not create the vdev, leaving arvif->is_created as false and arvif->ar NULL. Subsequent code paths allocate an ars...

CVE-2026-74366 wifi: ath12k: fix NULL deref in change_sta_links for unready link

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in changestalinks for unready link ieee80211setactivelinks calls ieee80211linkusechannel for each newly-added link and WARNONONCEs if it fails. The call uses assignonfailure=true, which allows mac8021...

CVE-2026-74342 kernfs: link kn to its parent before the LSM init hook

In the Linux kernel, the following vulnerability has been resolved: kernfs: link kn to its parent before the LSM init hook After commit 12e9e3cd03b5 "simpexattr: use per-sb cache", kernfsxattrset and kernfsxattrget compute the cache via kernfsrootkn before any other check. kernfsrootkn walks...