CVE-2026-74332

The CVE-2026-74332 entry relates to the Linux kernel ASoC: amd (acp-sdw-sof): Bound DAI link iteration. The issue occurred in create_sdw_dailinks() which walked sof_dais beyond allocated entries when all entries were initialized. A fix was implemented to pass the allocated entry count to create_s...

CVE-2026-74332 ASoC: amd: acp-sdw-sof: Bound DAI link iteration

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-sof: Bound DAI link iteration createsdwdailinks walks sofdais until it finds an entry with initialised cleared, but sofdais is allocated with exactly numends entries. If all entries are initialised, the loop...

CVE-2026-74329

The CVE-2026-74329 entry describes a Linux kernel issue in the watchdog subsystem: watchdog_register_device() may register wdd->pm_nb when WDOG_NO_PING_ON_SUSPEND is set, but watchdog_unregister_device() does not remove it, leaving an embedded notifier block on the PM notifier chain after the ...

EUVD-2026-59475

In the Linux kernel, the following vulnerability has been resolved: iommufd: Destroy the pages content after detaching from dmabuf Sashiko points out this has gotten out of order, the mutex could still be in use through the dmabuf invalidation callbacks. Don't destroy any of the pages content unt...

CVE-2026-74326

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix resource leak in probe error path When pcimiomapregion or devmkmemdup fail, the code returns directly without cleaning up previously allocated resources: - mt76device allocated by mt76allocdevice - pci irq...

CVE-2026-74303

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

CVE-2026-74291 ASoC: topology: Check PCM and DAI name strings before use

In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen checks before using them...

CVE-2026-74287

In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded address parameter length sctpverifyasconf and sctpverifyparam only validate ADDIP, DELIP, and SETPRIMARY parameters against a fixed minimum size of sizeofstruct sctpaddipparam + sizeofstruct sctpparamhdr...

CVE-2026-74283

In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAPNETADMIN when an operation sets GENLADMINPERM or...

CVE-2026-74279

In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sgcleanup error path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

CVE-2026-74273 cxl/region: Block region delete during region creation

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Block region delete during region creation Expand the range lock, rename it "regionslock", to disable region deletion in the critical period between constructregion and attachtarget, as well as the period between...

CVE-2026-74274

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fill first free targets slot during auto-discovery Any invalid endpoint decoder pointer in the target array of an active region is not allowed by cxl driver. This means cxl driver always assumes the first p-nrtargets...

CVE-2026-74274

The CVE-2026-74274 entry concerns the Linux kernel cxl/region auto-discovery logic. A NULL hole in a region’s target array (introduced when an endpoint decoder is removed or detached) could lead to null dereferences (possible Oops: general protection fault) or miscounting targets when lock flags ...

CVE-2026-74272 cxl/region: Resolve region deletion races

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Resolve region deletion races Sungwoo noticed that the sysfs trigger to delete a region may try to delete a region multiple times. It also has no exclusion relative to the kernel releasing the region via CXL root devi...

CVE-2026-74265 net: mana: initialize gdma queue id to INVALID_QUEUE_ID

In the Linux kernel, the following vulnerability has been resolved: net: mana: initialize gdma queue id to INVALIDQUEUEID managdcreatemanawqcq leaves queue-id as 0 from kzallocobj until manacreatewqobj assigns the firmware-returned id. If creation fails before that, cleanup calls managddestroycq...

CVE-2026-74256

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpfmsgpopdata bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l || las...

CVE-2026-72501 RDMA/bnxt_re: Initialize dpi variable to zero

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Initialize dpi variable to zero dpi is initialized only for BNXTREALLOCWCPAGE, but copied for all the cases. So initialize the dpi to 0...

CVE-2026-72501

The CVE-2026-72501 entry concerns the Linux kernel’s RDMA/bnxt_re code path. The bug was that the dpi variable was initialized only for BNXT_RE_ALLOC_WC_PAGE and then copied in other cases, potentially leaving an uninitialized dpi. The fix initializes dpi to 0 across all paths, resolving the issu...

EUVD-2026-59388

In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvecrxcompleted In nvecrxcompleted, when an incomplete RX transfer is detected, nvecmsgfree is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately aft...

CVE-2026-72476

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free In dmareleasechannel, check chan-device-privatecnt after call dmachanput. However, dmachanput call dmadeviceput which could release the last reference of the device if the DMA provider is...