CVE-2026-74718 devlink: fix net namespace reference leak in reload

In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlinknlreloaddoit calls devlinknetnsget, which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not...

CVE-2026-74718 devlink: fix net namespace reference leak in reload

In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlinknlreloaddoit calls devlinknetnsget, which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not...

CVE-2026-74707 xsk: validate metadata when processing requests

In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata...

CVE-2026-74707 xsk: validate metadata when processing requests

In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata...

EUVD-2026-64393

In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocation of auxrdev fails during auxiliary device setup, the error path calls auxiliarydeviceuninit, which eventually invokes bngeauxdevrelease. The release callback...

CVE-2026-74680

This vulnerability affects the Linux kernel 's cxacru USB ATM driver (drivers/usb/atm/cxacru.c). The root cause is a missing cleanup in cxacru_cm(): when an error occurs while submitting or waiting for snd_urb, the function returns early without killing the already-submitted rcv_urb, leaving it i...

CVE-2026-74680 usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()

In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: properly kill rcvurb on error in cxacrucm If cxacrucm encounters an error while submitting or waiting for sndurb, it aborts and returns the error without killing the already submitted rcvurb. This leaves the...

CVE-2026-74680 usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()

In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: properly kill rcvurb on error in cxacrucm If cxacrucm encounters an error while submitting or waiting for sndurb, it aborts and returns the error without killing the already submitted rcvurb. This leaves the...

EUVD-2026-64367

In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: properly kill rcvurb on error in cxacrucm If cxacrucm encounters an error while submitting or waiting for sndurb, it aborts and returns the error without killing the already submitted rcvurb. This leaves the...

CVE-2026-74667 net/packet: reset the MAC header on the packet-socket transmit path

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

EUVD-2026-64354

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

CVE-2026-74658 futex: Prevent robust futex exit race some more

In the Linux kernel, the following vulnerability has been resolved: futex: Prevent robust futex exit race some more A robust futex unlock stores 0 over the whole futex value - wiping FUTEXWAITERS - and wakes a single waiter. That wakeup is a one-shot notification: the protocol relies on its...

CVE-2026-74654 serial: 8250_dma: Clear stale RX state on shutdown

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

CVE-2026-74625 netfilter: bridge: release template ct on non-IP path

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nfctbridgepre sees it. For non-IPv4 and non-IPv6 EtherTypes, nfctbridgepre currently...

EUVD-2026-64562

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nfctbridgepre sees it. For non-IPv4 and non-IPv6 EtherTypes, nfctbridgepre currently...

CVE-2026-74625

A memory leak vulnerability in the Linux kernel netfilter bridge component affects systems with a bridge nftables ct zone set rule. When non-IPv4 and non-IPv6 EtherType frames are processed, nf_ct_bridge_pre() overwrites skb->_nfct with IP_CT_UNTRACKED without releasing the existing conntrack ...

CVE-2026-74625 netfilter: bridge: release template ct on non-IP path

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nfctbridgepre sees it. For non-IPv4 and non-IPv6 EtherTypes, nfctbridgepre currently...

CVE-2026-74611 tls: rx: restore msg_iter before TLS 1.3 optimistic retry

In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msgiter before TLS 1.3 optimistic retry tlsdecryptsg advances msg-msgiter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data,...

CVE-2026-74604 Revert "thermal/drivers/hwmon: Cleanup coding style a bit"

In the Linux kernel, the following vulnerability has been resolved: Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Revert commit 030a48b0f6ce "thermal/drivers/hwmon: Cleanup coding style a bit" that introduced a use-after-free into the error path of thermaladdhwmonsysfs by removing a...

CVE-2026-74604

CVE-2026-74604 is a use-after-free vulnerability in the Linux kernel's thermal/drivers/hwmon component. It was introduced by commit 030a48b0f6ce ("thermal/drivers/hwmon: Cleanup coding style a bit"), which removed a valid check from the error path of thermal_add_hwmon_sysfs() . The fix is a rever...