CVE-2026-74677 net: usb: ipheth: fix carrier_work UAF on disconnect

In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrierwork UAF on disconnect iphethsndbulkcallback re-arms the carrier-check work on any non-zero URB status: else scheduledelayedwork&dev-carrierwork, 0; Nothing ties that to the interface being up, so the...

EUVD-2026-64365

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179178a: fix skb leak in ax88179txfixup When the interface has NETIFFSG enabled and skblinearize fails in ax88179txfixup, the function returns NULL without freeing the skb. usbnetstartxmit treats a NULL return from...

CVE-2026-74677 net: usb: ipheth: fix carrier_work UAF on disconnect

In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrierwork UAF on disconnect iphethsndbulkcallback re-arms the carrier-check work on any non-zero URB status: else scheduledelayedwork&dev-carrierwork, 0; Nothing ties that to the interface being up, so the...

CVE-2026-74678 net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179178a: fix skb leak in ax88179txfixup When the interface has NETIFFSG enabled and skblinearize fails in ax88179txfixup, the function returns NULL without freeing the skb. usbnetstartxmit treats a NULL return from...

CVE-2026-74678

CVE-2026-74678 is a memory leak in the Linux kernel's ax88179_178a USB network driver. When NETIF_F_SG is enabled and skb_linearize() fails inside ax88179_tx_fixup() , the function returns NULL without freeing the skb. The caller, usbnet_start_xmit() , then holds a NULL local reference, so the or...

CVE-2026-74678 net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179178a: fix skb leak in ax88179txfixup When the interface has NETIFFSG enabled and skblinearize fails in ax88179txfixup, the function returns NULL without freeing the skb. usbnetstartxmit treats a NULL return from...

EUVD-2026-64579

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

CVE-2026-74642 ALSA: usb: Fix UAF at delayed release of MIDI2 EPs

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

CVE-2026-74642

CVE-2026-74642 is a Use-After-Free (UAF) vulnerability in the Linux kernel's ALSA USB subsystem , specifically in the handling of MIDI 2.0 (UMP) endpoints . A prior fix for a UAF in ump_to_endpoint() inadvertently introduced a second UAF: the code dereferences the UMP endpoint object in a delayed...

CVE-2026-74642 ALSA: usb: Fix UAF at delayed release of MIDI2 EPs

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

CVE-2026-74639

CVE-2026-74639 is a use-after-free in the Linux kernel's ALSA us144mkii driver (Tascam US-144MKII USB audio interface). The root cause is that capture_urb_complete() resubmits capture URBs without re-anchoring them. Since anchoring is a property of a submission (not the URB itself), the anchor be...

CVE-2026-74639 ALSA: us144mkii: re-anchor capture URBs on resubmission

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: re-anchor capture URBs on resubmission captureurbcomplete resubmits each capture URB without anchoring it: usbgeturburb; ret = usbsubmiturburb, GFPATOMIC; Anchoring is a property of a submission, not of the URB...

CVE-2026-74639 ALSA: us144mkii: re-anchor capture URBs on resubmission

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: re-anchor capture URBs on resubmission captureurbcomplete resubmits each capture URB without anchoring it: usbgeturburb; ret = usbsubmiturburb, GFPATOMIC; Anchoring is a property of a submission, not of the URB...

Linux Distros Unpatched Vulnerability : CVE-2026-74682

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter:...

Linux Distros Unpatched Vulnerability : CVE-2026-74680

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: atm: cxacru: properly kill rcvurb on error in cxacrucm If cxacrucm encounters an error while submitting or waiting for sndurb, it aborts and returns the...

Linux Distros Unpatched Vulnerability : CVE-2026-74642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint...

Linux Distros Unpatched Vulnerability : CVE-2026-74677

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: usb: ipheth: fix carrierwork UAF on disconnect iphethsndbulkcallback re-arms the carrier-check work on any non-zero URB status: else...

PT-2026-79647

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in ump to endpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

PT-2026-79684

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f ncm: Use unsigned int for ndp index The variable ndp index is declared as a signed integer, but it stores the return value of get ncm, which is unsigned. A malicious host can supply a large offset that overflows th...

PT-2026-79644

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: re-anchor capture URBs on resubmission capture urb complete resubmits each capture URB without anchoring it: usb get urburb; ret = usb submit urburb, GFP ATOMIC; Anchoring is a property of a submission, not of th...