CVE-2026-74628

CVE-2026-74628 is a use-after-free in the Linux kernel's net/x25 (X.25 protocol) subsystem. The root cause is that x25 timers are armed with mod_timer() and cancelled with timer_delete(), meaning a pending timer holds no reference on the socket. Because x25_heartbeat_expiry() rearms unconditional...

CVE-2026-74629 net/dibs: Correct freeing of dmb_clientid_arr

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmbclientidarr A dibs device interrupt handler can be active after dibsdevdel and may still access dmbclientidarr. UAF In case of a failure in dibsdevadd being called by dibslodevprobe dmbclientidarr ...

EUVD-2026-64566

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmbclientidarr A dibs device interrupt handler can be active after dibsdevdel and may still access dmbclientidarr. UAF In case of a failure in dibsdevadd being called by dibslodevprobe dmbclientidarr ...

CVE-2026-74628 net/x25: fix use-after-free of the socket by its timers

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with modtimer and cancelled with timerdelete, so a pending timer holds no reference on the socket and a cancel does not wait for a callback already...

CVE-2026-74629 net/dibs: Correct freeing of dmb_clientid_arr

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmbclientidarr A dibs device interrupt handler can be active after dibsdevdel and may still access dmbclientidarr. UAF In case of a failure in dibsdevadd being called by dibslodevprobe dmbclientidarr ...

CVE-2026-74629

CVE-2026-74629 affects the Linux kernel's dibs (Device In-Band Signaling) subsystem and involves two memory-management defects in the lifecycle of dmb_clientid_arr. First, a use-after-free occurs when a dibs device interrupt handler remains active after dibs_dev_del() and continues to access the ...

CVE-2026-74615 vxlan: do not arm the ageing timer on a device that is down

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlanchangelink arms vxlan-agetimer whenever the requested ageing interval differs from the configured one: if conf.ageinterval != vxlan-cfg.ageinterval...

CVE-2026-74615

CVE-2026-74615 is a slab-use-after-free in the Linux kernel vxlan module. The root cause is that vxlan_changelink() arms the FDB ageing timer without a netif_running() check, so on a never-brought-up device the timer persists after free_netdev() releases the vxlan_dev struct, causing the timer co...

CVE-2026-74615 vxlan: do not arm the ageing timer on a device that is down

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlanchangelink arms vxlan-agetimer whenever the requested ageing interval differs from the configured one: if conf.ageinterval != vxlan-cfg.ageinterval...

EUVD-2026-64552

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlanchangelink arms vxlan-agetimer whenever the requested ageing interval differs from the configured one: if conf.ageinterval != vxlan-cfg.ageinterval...

EUVD-2026-64550

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: avoid refilling the RX queue after teardown Commit b917507e5ad9 "vsock/virtio: stop workers during the .remove" made the RX worker jump to its common exit when rxrun is clear. That exit still refills the RX queue wh...

CVE-2026-74613 vsock/virtio: avoid refilling the RX queue after teardown

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: avoid refilling the RX queue after teardown Commit b917507e5ad9 "vsock/virtio: stop workers during the .remove" made the RX worker jump to its common exit when rxrun is clear. That exit still refills the RX queue wh...

CVE-2026-74613

CVE-2026-74613 is a use-after-free in the Linux kernel's vsock/virtio transport (net/vmw_vsock/virtio_transport.c). A prior commit (b917507e5ad9) made the RX worker jump to a common exit path when rx_run is clear, but that path still refills the RX queue when the buffer count is low. Work queued ...

CVE-2026-74614 vsock/virtio: read virtqueues under worker locks

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b "vsock/virtio: add support for device suspend/resume" made the run flags transition from false to true when restore installs replacement virtqueues. The RX, TX...

EUVD-2026-64551

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b "vsock/virtio: add support for device suspend/resume" made the run flags transition from false to true when restore installs replacement virtqueues. The RX, TX...

CVE-2026-74613 vsock/virtio: avoid refilling the RX queue after teardown

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: avoid refilling the RX queue after teardown Commit b917507e5ad9 "vsock/virtio: stop workers during the .remove" made the RX worker jump to its common exit when rxrun is clear. That exit still refills the RX queue wh...

CVE-2026-74614

A flaw in the Linux kernel's vsock/virtio driver allows a stale pointer to a deleted virtqueue to be retained by RX, TX, or event workers during suspend/resume cycles. The root cause is a lock ordering issue introduced by commit bd50c5dc182b (device suspend/resume support): workers read their vir...

CVE-2026-74614 vsock/virtio: read virtqueues under worker locks

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b "vsock/virtio: add support for device suspend/resume" made the run flags transition from false to true when restore installs replacement virtqueues. The RX, TX...

CVE-2026-74609 tipc: read le->link under the node lock in tipc_node_link_down()

In the Linux kernel, the following vulnerability has been resolved: tipc: read le-link under the node lock in tipcnodelinkdown tipcnodelinkdown caches the link pointer before taking n-lock: struct tipclink l = le-link; / unlocked / if !l return; tipcnodewritelockn; if !tipclinkisestablishingl /...

CVE-2026-74609

CVE-2026-74609 is a use-after-free race condition in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem, specifically in tipc_node_link_down(). The function caches the le->link pointer before acquiring n->lock, then dereferences it under the lock. A concurrent delet...