CVE-2026-74525

In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fails, initdmadescrings only frees the partially allocated RX rings and returns. The TX rings that were allocated earlier in the same function...

CVE-2026-74559

In the Linux kernel, the following vulnerability has been resolved: xsk: drain continuation descs after overflow in xskbuildskb Fix generic xmit path multi-buffer logic when packets are either too big count of descriptors exceed MAXSKBFRAGS or an invalid descriptor is included in fragmented packe...

CVE-2026-74558

In the Linux kernel, the following vulnerability has been resolved: xsk: reclaim invalid Tx descriptors in ZC batch path The zero-copy Tx batch parser stops when it encounters an invalid descriptor. If this happens after one or more continuation descriptors, the Tx consumer can be advanced past...

EUVD-2026-59623

In the Linux kernel, the following vulnerability has been resolved: xsk: reclaim invalid Tx descriptors in ZC batch path The zero-copy Tx batch parser stops when it encounters an invalid descriptor. If this happens after one or more continuation descriptors, the Tx consumer can be advanced past...

EUVD-2026-59718

In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fails, initdmadescrings only frees the partially allocated RX rings and returns. The TX rings that were allocated earlier in the same function...

CVE-2026-74525 net: sxgbe: free TX rings on RX allocation failure

In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fails, initdmadescrings only frees the partially allocated RX rings and returns. The TX rings that were allocated earlier in the same function...

CVE-2026-74525

CVE-2026-74525 affects the Linux kernel net sxgbe driver. When RX descriptor ring allocation fails, init_dma_desc_rings() frees partial RX rings but leaks TX rings allocated earlier. The fix rearranges error labels to clean up TX rings on RX failure. Affected component: net/sxgbe RX/TX ring initi...

CVE-2026-74447

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected EOP buffer size is computed as ALIGNeopringbuffersize, PAGESIZE; ALIG...

EUVD-2026-59754

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected EOP buffer size is computed as ALIGNeopringbuffersize, PAGESIZE; ALIG...

CVE-2026-74447

CVE-2026-74447: In the Linux kernel, drm/amdkfd, the EOP ring buffer size alignment uses a 32-bit value, causing wrap when computing ALIGN(eop_ring_buffer_size, PAGE_SIZE). A user-supplied size like 0xFFFFF001 wraps to 0, letting kfd_queue_buffer_get() bypass the exact-size check and accept any B...

CVE-2026-74309

In the Linux kernel, the following vulnerability has been resolved: vdpa/octeonep: fix IRQ-to-ring mapping in interrupt handler Look up the IRQ index in octhw-irqs instead of assuming irq - irqs0. This supports non-contiguous IRQ numbers and avoids incorrect ring indexing when irqs0 is not the ba...

CVE-2026-72339

In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on buildskb failure qederxbuildskb and qedetparxbuildskb do not check for a NULL return from qedebuildskb. When it returns NULL under memory pressure, the functions still consume a BD...

CVE-2026-74356 vhost: fix vhost_get_avail_idx for a non empty ring

In the Linux kernel, the following vulnerability has been resolved: vhost: fix vhostgetavailidx for a non empty ring vhostgetavailidx is supposed to report whether it has updated vq-availidx. Instead, it returns whether all entries have been consumed, which is usually the same. But not always - i...

CVE-2026-74356 vhost: fix vhost_get_avail_idx for a non empty ring

In the Linux kernel, the following vulnerability has been resolved: vhost: fix vhostgetavailidx for a non empty ring vhostgetavailidx is supposed to report whether it has updated vq-availidx. Instead, it returns whether all entries have been consumed, which is usually the same. But not always - i...

EUVD-2026-59456

In the Linux kernel, the following vulnerability has been resolved: vdpa/octeonep: fix IRQ-to-ring mapping in interrupt handler Look up the IRQ index in octhw-irqs instead of assuming irq - irqs0. This supports non-contiguous IRQ numbers and avoids incorrect ring indexing when irqs0 is not the ba...

CVE-2026-74309

The CVE-2026-74309 entry concerns the Linux kernel driver for vdpa/octeon_ep. The root cause was incorrect IRQ-to-ring mapping in the interrupt handler due to assuming irq - irqs[0] for the ring index. The fix updates the IRQ lookup to use oct_hw->irqs to determine the correct index, supportin...

EUVD-2026-59279

In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response reqid before indexing rsp pvcallsfronteventhandler takes reqid directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a store, wi...

CVE-2026-72339

In the Linux kernel, CVE-2026-72339 affects the qede path: qede_rx_build_skb() and qede_tpa_rx_build_skb() fail to check NULL from qede_build_skb() under memory pressure, causing an off-by-one in BD (buffer descriptor) ring consumption and desynchronization. This can corrupt DMA page reference co...

CVE-2026-72339 qede: fix off-by-one in BD ring consumption on build_skb failure

In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on buildskb failure qederxbuildskb and qedetparxbuildskb do not check for a NULL return from qedebuildskb. When it returns NULL under memory pressure, the functions still consume a BD...

CVE-2026-72339 qede: fix off-by-one in BD ring consumption on build_skb failure

In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on buildskb failure qederxbuildskb and qedetparxbuildskb do not check for a NULL return from qedebuildskb. When it returns NULL under memory pressure, the functions still consume a BD...