CVE-2026-74631

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smcrxsplice smcrxsplice passes pages to splicetopipe before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splicetopipe may drop...

CVE-2026-74628

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with modtimer and cancelled with timerdelete, so a pending timer holds no reference on the socket and a cancel does not wait for a callback already...

CVE-2026-74629

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmbclientidarr A dibs device interrupt handler can be active after dibsdevdel and may still access dmbclientidarr. UAF In case of a failure in dibsdevadd being called by dibslodevprobe dmbclientidarr ...

CVE-2026-74627

In the Linux kernel, the following vulnerability has been resolved: net: devmem: prevent net-iov / page mixing We should either have netiov or page backed frags in a single skb, otherwise it blows up down the stack. Don't allow mixing in zerocopyfillskbfromdevmem...

CVE-2026-74626

In the Linux kernel, the following vulnerability has been resolved: NTB: ntbnetdev: Preserve RX queue depth on allocation failure ntbnetdevrxhandler hands the received skb to the network stack before allocating its replacement. If the allocation fails, nothing is reposted. Every failure therefore...

CVE-2026-74623

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free stranded TX buffers on ring deinit aqvecdeinit drains the TX rings with a single aqringtxclean call, which frees at most AQCFGTXCLEANBUDGET 256 descriptors and stops at hwhead, which no longer moves once...

CVE-2026-74620

In the Linux kernel, the following vulnerability has been resolved: net/sched: actgact, actpolice: range check the fallback control action tcfactioncheckctrlact range checks the primary control action: if !opcode ret = action TCACTVALUEMAX ? -EINVAL : 0; TCACTVALUEMAX is TCACTTRAP, so...

CVE-2026-74619

In the Linux kernel, the following vulnerability has been resolved: ovl: don't warn when the mount is completed from another user namespace fsopen records the caller's user namespace in fc-userns and hands back an ordinary file descriptor. Nothing ties the task that calls fsconfigFSCONFIGCMDCREAT...

CVE-2026-74616

In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skbsharedinfo tailroom xdpfclone clones broadcast copies into a single page and sets framesz to PAGESIZE. xdpbuildskbfromframe later treats that page like a normal XDP frame and expects the usual...

CVE-2026-74613

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: avoid refilling the RX queue after teardown Commit b917507e5ad9 "vsock/virtio: stop workers during the .remove" made the RX worker jump to its common exit when rxrun is clear. That exit still refills the RX queue wh...

CVE-2026-74612

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

CVE-2026-74611

In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msgiter before TLS 1.3 optimistic retry tlsdecryptsg advances msg-msgiter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data,...

CVE-2026-74607

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Interaction between KVMCAPVMMOVEENCCONTEXTFROM and KVMCAPVMCOPYENCCONTEXTFROM can cause two separate issues: - in sevmigratefrom, when the destination K...

CVE-2026-74605

In the Linux kernel, the following vulnerability has been resolved: eventfs: Use children field for rcu head and add memory barriers When an eventfs inode is freed, it sets ei-isfreed and then uses its ei-list to add it to the srcu link list as the list field is a union with the rcu list head. As...

CVE-2026-74606

In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfsremoverec eventfsremoverec recursively removes the child at the current loop position. After the recursive call returns, listforeachentry advances by reading list.next from the removed child...

CVE-2026-74602

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Initialise reader page order in rballocatecpubuffer In rballocatecpubuffer, bpage-order was omitted, leaving it as 0. This is an issue for a ring-buffer with subbufs bigger than PAGESIZE if when freed: freebufferpage...

CVE-2026-74601

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Use currentcontext for safe per-CPU buffer swap The ringbufferswapcpu function currently checks the per-CPU committing counter to determine if a buffer is actively being written to before performing the swap. However...

CVE-2026-74599

In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: always stabilise against page table freeing using initmm Previous commits have established the invariant that kernel page table freeing is performed while an mmap read lock on initmm is held, which fixes races between...

CVE-2026-74597

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: clear skb2-cb in ip6ip6err ip6ip6err clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6send. The clone still carries the outer packet's inet6skbparm in...

CVE-2026-74598

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...