UBUNTU-CVE-2026-74689

In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vccsetsockopt vccsetsockopt contained an ineffective optlen check: if SOLEVELMATCHoptname, level && optlen != SOSIZEoptname return -EINVAL; If SOLEVELMATCHoptname, level evaluated to false...

UBUNTU-CVE-2026-74612

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

EUVD-2026-64410

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers BUG For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: BUG: KASAN: slab-out-of-bounds in...

CVE-2026-74724

This vulnerability affects the Linux kernel's IPVS (IP Virtual Server) component, specifically the ip_vs_nat_icmp function. A local attacker with low privileges can modify a packet while it is being processed by IPVS. The root cause is that the IP IHL (Internet Header Length) field is read multip...

CVE-2026-74723 btrfs: lzo: reject inline extents without valid headers

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers BUG For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: BUG: KASAN: slab-out-of-bounds in...

EUVD-2026-64411

In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ipvsnaticmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such...

CVE-2026-74724 ipvs: avoid out-of-bounds write in ip_vs_nat_icmp

In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ipvsnaticmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such...

CVE-2026-74723

A slab-out-of-bounds read in the Linux kernel's btrfs LZO decompression path is triggered when a crafted btrfs image contains an inline LZO compressed file extent with only an LZO header but no segment header or payload. The lzo_decompress() function reads beyond the item boundary; if the extent ...

CVE-2026-74724 ipvs: avoid out-of-bounds write in ip_vs_nat_icmp

In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ipvsnaticmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such...

CVE-2026-74723 btrfs: lzo: reject inline extents without valid headers

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers BUG For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: BUG: KASAN: slab-out-of-bounds in...

EUVD-2026-64399

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 mlx5core Read of size 272 at addr 0000000176795020 by task...

CVE-2026-74712

CVE-2026-74712 is a slab-out-of-bounds read in the Linux kernel's vdpa/mlx5 driver. The create_direct_keys() function incorrectly calculates the input buffer size by including the entire structure (out + in + mtt[]) while the pointer passed to cmd_exec targets only the in field. This causes mlx5_...

CVE-2026-74712 vdpa/mlx5: Fix buffer length in create_direct_keys()

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 mlx5core Read of size 272 at addr 0000000176795020 by task...

CVE-2026-74712 vdpa/mlx5: Fix buffer length in create_direct_keys()

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 mlx5core Read of size 272 at addr 0000000176795020 by task...

CVE-2026-74711

A type confusion vulnerability in the Linux kernel's hwmon/pmbus driver (drivers/hwmon/pmbus/pmbus_core.c) arises in pmbus_notify(), which unconditionally casts every attribute in data->group.attrs to struct sensor_device_attribute. When the attribute is actually a struct pmbus_samples_reg, th...

EUVD-2026-64397

In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AFXDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the...

CVE-2026-74710 xsk: require at least 16 bytes of TX metadata

In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AFXDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the...

EUVD-2026-64398

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbusnotify, the code unconditionally casts every attribute to a struct sensordeviceattribute:...

CVE-2026-74710

CVE-2026-74710 is an out-of-bounds read in the Linux kernel's AF_XDP (xsk) component. The mechanism accepts a TX metadata length as small as eight bytes, but every supported request requires the flags field plus at least one eight-byte request field (16 bytes minimum). When metadata shorter than ...

CVE-2026-74711 hwmon: (pmbus) Fix type confusion in notification logic

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbusnotify, the code unconditionally casts every attribute to a struct sensordeviceattribute:...