CVE-2026-74634 ring-buffer: Prevent subbuf order change when resizing is disabled

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ringbuffersubbuforderset frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rbadvanceite...

EUVD-2026-64571

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ringbuffersubbuforderset frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rbadvanceite...

CVE-2026-74634 ring-buffer: Prevent subbuf order change when resizing is disabled

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ringbuffersubbuforderset frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rbadvanceite...

CVE-2026-74631

CVE-2026-74631 affects the Linux kernel net: smc subsystem, specifically the smc_rx_splice() function. The root cause is a splice entry lifetime imbalance : pages are passed to splice_to_pipe() before the references covering each entry's lifetime are taken. In the VM-backed RMB path, unqueued ent...

CVE-2026-74631 net: smc: fix splice entry lifetime imbalance in smc_rx_splice

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smcrxsplice smcrxsplice passes pages to splicetopipe before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splicetopipe may drop...

EUVD-2026-64568

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smcrxsplice smcrxsplice passes pages to splicetopipe before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splicetopipe may drop...

CVE-2026-74631 net: smc: fix splice entry lifetime imbalance in smc_rx_splice

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smcrxsplice smcrxsplice passes pages to splicetopipe before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splicetopipe may drop...

CVE-2026-74630

A use-after-free vulnerability in the Linux kernel's IPv6 subsystem, specifically in in6_dev_get(). The function reads dev->ip6_ptr under RCU and unconditionally increments the refcount, but device teardown can clear the pointer and drop the last reference between these two operations, resurre...

CVE-2026-74630 ipv6: prevent in6_dev_get() from resurrecting inet6_dev

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6devget from resurrecting inet6dev in6devget reads dev-ip6ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these operations...

EUVD-2026-64567

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6devget from resurrecting inet6dev in6devget reads dev-ip6ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these operations...

CVE-2026-74630 ipv6: prevent in6_dev_get() from resurrecting inet6_dev

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6devget from resurrecting inet6dev in6devget reads dev-ip6ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these operations...

EUVD-2026-64565

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with modtimer and cancelled with timerdelete, so a pending timer holds no reference on the socket and a cancel does not wait for a callback already...

CVE-2026-74628 net/x25: fix use-after-free of the socket by its timers

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with modtimer and cancelled with timerdelete, so a pending timer holds no reference on the socket and a cancel does not wait for a callback already...

CVE-2026-74628

CVE-2026-74628 is a use-after-free in the Linux kernel's net/x25 (X.25 protocol) subsystem. The root cause is that x25 timers are armed with mod_timer() and cancelled with timer_delete(), meaning a pending timer holds no reference on the socket. Because x25_heartbeat_expiry() rearms unconditional...

CVE-2026-74629 net/dibs: Correct freeing of dmb_clientid_arr

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmbclientidarr A dibs device interrupt handler can be active after dibsdevdel and may still access dmbclientidarr. UAF In case of a failure in dibsdevadd being called by dibslodevprobe dmbclientidarr ...

EUVD-2026-64566

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmbclientidarr A dibs device interrupt handler can be active after dibsdevdel and may still access dmbclientidarr. UAF In case of a failure in dibsdevadd being called by dibslodevprobe dmbclientidarr ...

CVE-2026-74628 net/x25: fix use-after-free of the socket by its timers

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with modtimer and cancelled with timerdelete, so a pending timer holds no reference on the socket and a cancel does not wait for a callback already...

CVE-2026-74629

CVE-2026-74629 affects the Linux kernel's dibs (Device In-Band Signaling) subsystem and involves two memory-management defects in the lifecycle of dmb_clientid_arr. First, a use-after-free occurs when a dibs device interrupt handler remains active after dibs_dev_del() and continues to access the ...

CVE-2026-74629 net/dibs: Correct freeing of dmb_clientid_arr

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmbclientidarr A dibs device interrupt handler can be active after dibsdevdel and may still access dmbclientidarr. UAF In case of a failure in dibsdevadd being called by dibslodevprobe dmbclientidarr ...

CVE-2026-74615 vxlan: do not arm the ageing timer on a device that is down

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlanchangelink arms vxlan-agetimer whenever the requested ageing interval differs from the configured one: if conf.ageinterval != vxlan-cfg.ageinterval...