CVE-2026-74718 devlink: fix net namespace reference leak in reload

In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlinknlreloaddoit calls devlinknetnsget, which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not...

CVE-2026-74718

This vulnerability affects the Linux kernel devlink subsystem. In devlink_nl_reload_doit(), a call to devlink_netns_get() acquires a reference to a network namespace. When the requested namespace differs from the current one and the reload action is not DRIVER_REINIT, the function returns -EOPNOT...

CVE-2026-74718 devlink: fix net namespace reference leak in reload

In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlinknlreloaddoit calls devlinknetnsget, which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not...

EUVD-2026-64405

In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlinknlreloaddoit calls devlinknetnsget, which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not...

CVE-2026-74679

CVE-2026-74679 affects the Linux kernel USB gadget NCM function (f_ncm). The variable ndp_index is declared as a signed integer but stores the unsigned return value of get_ncm(). A malicious host can supply a large offset that overflows the signed ndp_index, making it negative. Because the value ...

CVE-2026-74679 usb: gadget: f_ncm: Use unsigned int for ndp_index

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...

CVE-2026-74679 usb: gadget: f_ncm: Use unsigned int for ndp_index

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...

EUVD-2026-64366

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...

CVE-2026-74679

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...

EUVD-2026-64365

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179178a: fix skb leak in ax88179txfixup When the interface has NETIFFSG enabled and skblinearize fails in ax88179txfixup, the function returns NULL without freeing the skb. usbnetstartxmit treats a NULL return from...

CVE-2026-74678

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179178a: fix skb leak in ax88179txfixup When the interface has NETIFFSG enabled and skblinearize fails in ax88179txfixup, the function returns NULL without freeing the skb. usbnetstartxmit treats a NULL return from...

CVE-2026-74678 net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179178a: fix skb leak in ax88179txfixup When the interface has NETIFFSG enabled and skblinearize fails in ax88179txfixup, the function returns NULL without freeing the skb. usbnetstartxmit treats a NULL return from...

CVE-2026-74678 net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179178a: fix skb leak in ax88179txfixup When the interface has NETIFFSG enabled and skblinearize fails in ax88179txfixup, the function returns NULL without freeing the skb. usbnetstartxmit treats a NULL return from...

CVE-2026-74678

CVE-2026-74678 is a memory leak in the Linux kernel's ax88179_178a USB network driver. When NETIF_F_SG is enabled and skb_linearize() fails inside ax88179_tx_fixup() , the function returns NULL without freeing the skb. The caller, usbnet_start_xmit() , then holds a NULL local reference, so the or...

CVE-2026-74674 mm: fix incorrect flush address in direct page table reclaim

In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zappterange reclaims a page table, it does: ptefreetlbtlb, pmdpgtablepmdval, addr; and this is unconditionally wrong: if this code executes, addr always points one...

CVE-2026-74674

In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zappterange reclaims a page table, it does: ptefreetlbtlb, pmdpgtablepmdval, addr; and this is unconditionally wrong: if this code executes, addr always points one...

CVE-2026-74674 mm: fix incorrect flush address in direct page table reclaim

In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zappterange reclaims a page table, it does: ptefreetlbtlb, pmdpgtablepmdval, addr; and this is unconditionally wrong: if this code executes, addr always points one...

EUVD-2026-64361

In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zappterange reclaims a page table, it does: ptefreetlbtlb, pmdpgtablepmdval, addr; and this is unconditionally wrong: if this code executes, addr always points one...

CVE-2026-74674

This vulnerability affects the Linux kernel 's memory management (mm) subsystem, specifically the zap_pte_range function. When reclaiming a page table, the function calls pte_free_tlb with an addr parameter that always points one past the end of the table's range, causing the TLB flush to target ...

CVE-2026-74651 staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwgetwpaie rtwgetwpaie reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short...