EUVD-2026-59551

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix snpfilterreservedmemregions off-by-one Sashiko notes: regarding the bounds check in snpfilterreservedmemregions called via walkiomemresdesc: does the check if rangelist-numelements 16 + 8 PAGESIZE allow an...

CVE-2026-74399

The CVE-2026-74399 issue concerns the Linux kernel evm subsystem, specifically evm_read_xattrs. The function allocates a buffer for xattrs and, when no configured xattrs are enabled, leaves temp[0] uninitialized, causing strlen(temp) to read past initialized memory. The fix terminates the buffer ...

CVE-2026-74394 RDMA/srpt: fix integer overflow in immediate data length check

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check immbuf-len is a user-controlled uint32t received from the network. Adding it to immdataoffset without overflow checking allows a malicious initiator to send...

EUVD-2026-59541

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check immbuf-len is a user-controlled uint32t received from the network. Adding it to immdataoffset without overflow checking allows a malicious initiator to send...

CVE-2026-74393

In the Linux kernel, the following vulnerability has been resolved: drm/syncobj: Fix memory leak in drmsyncobjfindfence Commit 18226ba52159 "drm/syncobj: reject invalid flags in drmsyncobjfindfence" forgot to take into account the fact that drmsyncobjfind takes a reference to syncobj and returns...

CVE-2026-74391 tracing: Bound synthetic-field strings with seq_buf

In the Linux kernel, the following vulnerability has been resolved: tracing: Bound synthetic-field strings with seqbuf The synthetic field helpers build a prefixed synthetic variable name and a generated hist command in fixed MAXFILTERSTRVAL buffers. The current code appends those strings with ra...

CVE-2026-74391

In CVE-2026-74391, the Linux kernel tracing subsystem is affected by a buffer-overflow risk in synthetic-field string construction. The vulnerability arises because synthetic field helpers append strings with strcat() to fixed MAX_FILTER_STR_VAL buffers, allowing long key lists, field names, or s...

CVE-2026-74391 tracing: Bound synthetic-field strings with seq_buf

In the Linux kernel, the following vulnerability has been resolved: tracing: Bound synthetic-field strings with seqbuf The synthetic field helpers build a prefixed synthetic variable name and a generated hist command in fixed MAXFILTERSTRVAL buffers. The current code appends those strings with ra...

EUVD-2026-59538

In the Linux kernel, the following vulnerability has been resolved: tracing: Bound synthetic-field strings with seqbuf The synthetic field helpers build a prefixed synthetic variable name and a generated hist command in fixed MAXFILTERSTRVAL buffers. The current code appends those strings with ra...

CVE-2026-74369

In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix u-a-f in luofileunpreservefiles and luofilefinish In luofileunpreservefiles and luofilefinish, reorder moduleput and xaerase to ensure the file handler module remains pinned while its operations are being accessed...

EUVD-2026-59508

In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used instead of =, incorrectly accepting fdpidx when it equals n i.e. NUMFDPC + 1...

CVE-2026-74361

The CVE-2026-74361 entry covers a Linux kernel issue in the NVMe subsystem: the FDP fdpcidx bounds check incorrectly used > instead of >=, allowing fdp_idx when it equals NUMFDPC+1. The vulnerability is resolved by the patch in the referenced kernel commits (fix bounds check in fdpcidx). Th...

CVE-2026-74354

In the Linux kernel, the following vulnerability has been resolved: bpf: Take mmaplock in zappages zapvmarange requires the owning mm's mmaplock to be held. Taking mmapreadlock under arena-lock would AB-BA against arenavmclose and arenamapmmap, both of which run with mmapwritelock held and then...

CVE-2026-74350 ocfs2: validate fast symlink target during inode read

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate fast symlink target during inode read ocfs2validateinodeblock already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same treatmen...

CVE-2026-74351

In the Linux kernel, the following vulnerability has been resolved: ocfs2: rebase copied fsdlm LVB pointers in lockingstate The lockingstate debugfs iterator snapshots struct ocfs2lockres by value under ocfs2dlmtrackinglock and later formats that copy in ocfs2dlmseqshow. That is fine for the inli...

CVE-2026-74333 ASoC: amd: acp-sdw-legacy: Bound DAI link iteration

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-legacy: Bound DAI link iteration createsdwdailinks walks socdais until it finds an entry with initialised cleared, but socdais is allocated with exactly numends entries. If all entries are initialised, the loop...

CVE-2026-74332 ASoC: amd: acp-sdw-sof: Bound DAI link iteration

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-sof: Bound DAI link iteration createsdwdailinks walks sofdais until it finds an entry with initialised cleared, but sofdais is allocated with exactly numends entries. If all entries are initialised, the loop...

CVE-2026-74322

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996macwritetxwi80211 For injected frames e.g. via radiotap, mac80211 can pass info-control.vif = NULL, as explicitly noted in struct ieee80211txinfo. Check vif point...

CVE-2026-74320 fbdev: sm501fb: Fix buffer errors in OF binding code

In the Linux kernel, the following vulnerability has been resolved: fbdev: sm501fb: Fix buffer errors in OF binding code The code that gets the frame buffer mode from OF has 'use after free', 'buffer overrun' and memory leaks. info-ediddata isn't free if the probe functions fail or if pd-defmode ...

CVE-2026-74315

In the Linux kernel, the following vulnerability has been resolved: lockd: Avoid hashing uninitialized bytes in nlm4svclookupfile filehash digests the first LOCKDFHHASHSIZE bytes of nfsfh.data when bucketing nlmfiles, independent of fh.size. Commit 3de744ee4e45 "lockd: Use xdrgen XDR functions fo...