CVE-2026-74259

Summary (mode C): CVE-2026-74259 affects the Linux kernel CIFS implementation. The issue arises when cifs files are not cleaned up before killing the superblock during unmount, allowing a NULL pointer dereference in cifsFileInfo_put_final which can trigger a BUG check. Reproduction notes outline ...

CVE-2026-74259 cifs: remove all cifs files before kill super

In the Linux kernel, the following vulnerability has been resolved: cifs: remove all cifs files before kill super Cifs files may be put into fileinfoputwq during umounting cifs. After umount done, cifsFileInfoputfinal is called, which cause following BUG: BUG: kernel NULL pointer dereference,...

CVE-2026-74256 bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpfmsgpopdata bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l || las...

CVE-2026-74256 bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpfmsgpopdata bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l || las...

CVE-2026-72502 tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSOBYFRAGS 0xFFFF When MTU is large, ip6defaultadvmss can return IPV6MAXPLEN 65535. This is interpreted by TCP as mssclamp, allowing the MSS to reach 65535. However, 0xFFFF is also...

CVE-2026-72502

The CVE-2026-72502 issue affects the Linux kernel TCP/IPv6 path: when MTU is large, ip6_default_advmss() could return IPV6_MAXPLEN (65535), which TCP could treat as mss_clamp, allowing an MSS of 65535. The bug also coalesces with GSO_BY_FRAGS (0xFFFF), causing a NULL pointer dereference if a TCP ...

EUVD-2026-59401

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSOBYFRAGS 0xFFFF When MTU is large, ip6defaultadvmss can return IPV6MAXPLEN 65535. This is interpreted by TCP as mssclamp, allowing the MSS to reach 65535. However, 0xFFFF is also...

CVE-2026-72502 tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSOBYFRAGS 0xFFFF When MTU is large, ip6defaultadvmss can return IPV6MAXPLEN 65535. This is interpreted by TCP as mssclamp, allowing the MSS to reach 65535. However, 0xFFFF is also...

CVE-2026-72490 staging: rtl8723bs: fix stainfo check in rtw_aes_decrypt

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtwaesdecrypt The null-pointer-guard was incorrect, returning FAIL on valid pointer. Invert the guard, so it returns FAIL on invalid pointer...

EUVD-2026-59384

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...

CVE-2026-72485

CVE-2026-72485 describes a Linux kernel vulnerability in the coresight platform where nr_outconns/nr_inconns were incremented before allocations, causing a premature counter bump and potential panics during cleanup when allocations failed. The issue affects the coresight_add_out_conn() and coresi...

CVE-2026-72485 coresight: platform: defer connection counter increment until alloc succeeds

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...

CVE-2026-72485 coresight: platform: defer connection counter increment until alloc succeeds

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...

CVE-2026-72468

Summary: CVE-2026-72468 affects the Linux kernel components xprtrdma/rpcrdma. A race between NFS/RDMA mount and RDMA device removal could trigger a NULL dereference in the kernel trace path. Affected context (from provided docs): rpcrdma_ep_create() and rpcrdma_create_id() interactions allow the ...

CVE-2026-72468 xprtrdma: Initialize re_id before removal registration

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize reid before removal registration rpcrdmacreateid registers ep-rern with the rpcrdma ibclient before returning the new rdmacmid to rpcrdmaepcreate. However rpcrdmaepcreate currently stores that pointer in...

CVE-2026-72468 xprtrdma: Initialize re_id before removal registration

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize reid before removal registration rpcrdmacreateid registers ep-rern with the rpcrdma ibclient before returning the new rdmacmid to rpcrdmaepcreate. However rpcrdmaepcreate currently stores that pointer in...

EUVD-2026-59367

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize reid before removal registration rpcrdmacreateid registers ep-rern with the rpcrdma ibclient before returning the new rdmacmid to rpcrdmaepcreate. However rpcrdmaepcreate currently stores that pointer in...

CVE-2026-72467

CVE-2026-72467 (Linux kernel, xprtrdma) : The vulnerability arises when frwr_wp_create() fails during connect and rpcrdma_xprt_connect() ignores the error, causing xprt_rdma_connect_worker() to incorrectly report success and set XPRT_CONNECTED. A subsequent NFS/RDMA read with a non‑4‑byte‑aligned...

CVE-2026-72467 xprtrdma: Check frwr_wp_create() during connect

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwrwpcreate during connect frwrwpcreate creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave...

EUVD-2026-59366

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwrwpcreate during connect frwrwpcreate creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave...