CVE-2026-74444 drm/vmwgfx: validate DRAW_PRIMITIVES header size before division

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAWPRIMITIVES header size before division vmwcmddraw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is u32 and is taken straight from the user-supplied command stream. When...

CVE-2026-74443

CVE-2026-74443 affects the Linux kernel DRM/vmwgfx path. The issue in vmw_cmd_dma() computes the DMA suffix location without ensuring header->size can contain both body and suffix, allowing an undersized header to underflow the suffix pointer and later overwrite verified fields of a relocated ...

EUVD-2026-59750

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmwcmddma locates the DMA suffix at unsigned long &cmd-body + header-size - sizeofsuffix without checking that header-size is large enough to contain both cmd-body an...

CVE-2026-74443 drm/vmwgfx: bound DMA command body size against suffix pointer

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmwcmddma locates the DMA suffix at unsigned long &cmd-body + header-size - sizeofsuffix without checking that header-size is large enough to contain both cmd-body an...

CVE-2026-74443 drm/vmwgfx: bound DMA command body size against suffix pointer

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmwcmddma locates the DMA suffix at unsigned long &cmd-body + header-size - sizeofsuffix without checking that header-size is large enough to contain both cmd-body an...

CVE-2026-18654 vulnerabilities

Vulnerabilities for packages: localstack...

AZL-96290 CVE-2026-72397 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/core honor vrmversion in pmbusdata2regvid pmbusdata2regvid hardcoded the VR11 encoding regardless of the vrmversion configured by the driver, while pmbusreg2datavid already switched on it. Any driver that selects a...

UBUNTU-CVE-2026-74389

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix log flood after cmdmbox failure hnsrocecmdmbox is the command interface between driver and hardware. When hardware is abnormal, the unlimited error printings after hnsrocecmdmbox failure will cause log flood and eve...

CVE-2026-74270

In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent tlshd. ACCEPT already requires GENLADMINPERM; DONE has ...

CVE-2026-72088

In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path If physdisk-inreset is set, the function returns directly without undoing the resources acquired for the command. Add the missing error cleanup by unmapping the IOACCEL2 SG...

CVE-2026-72081

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix I/O leak on unsupported additional CDB efctdispatchfcpcmd allocates an efctio before dispatching an unsolicited FCP command. If the command has an unsupported additional CDB, the function returns -EIO before...

UBUNTU-CVE-2026-72086

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...

UBUNTU-CVE-2026-72075

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix race condition in resetdevice sysfs callback The imspcuresetdevice sysfs callback calls imspcuexecutecommand without acquiring pcu-cmdmutex. This can lead to data races and corruption of the shared command...

UBUNTU-CVE-2026-72091

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...

CVE-2026-72086

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...

CVE-2026-72075

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix race condition in resetdevice sysfs callback The imspcuresetdevice sysfs callback calls imspcuexecutecommand without acquiring pcu-cmdmutex. This can lead to data races and corruption of the shared command...

CVE-2026-74389

Summary: CVE-2026-74389 affects the Linux kernel RDMA driver for HNS (hns_roce). When hns_roce_cmd_mbox() fails, the error path could flood logs due to unlimited ibdev_err/ibdev_warn outputs, potentially leading to a system crash. The fix replaces the non-limited error prints with ratelimited ver...

CVE-2026-74270

The CVE-2026-74270 vulnerability affects the Linux kernel handling of the handshake genl family. The DONE downcall previously performed no privilege check, allowing an unprivileged process that could observe or guess a valid socket to submit DONE with HANDSHAKE_A_DONE_STATUS == 0, causing the ker...

CVE-2026-74270 handshake: Require admin permission for DONE command

In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent tlshd. ACCEPT already requires GENLADMINPERM; DONE has ...

CVE-2026-74270 handshake: Require admin permission for DONE command

In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent tlshd. ACCEPT already requires GENLADMINPERM; DONE has ...