CVE-2026-74309

In the Linux kernel, the following vulnerability has been resolved: vdpa/octeonep: fix IRQ-to-ring mapping in interrupt handler Look up the IRQ index in octhw-irqs instead of assuming irq - irqs0. This supports non-contiguous IRQ numbers and avoids incorrect ring indexing when irqs0 is not the ba...

CVE-2026-74304

The CVE-2026-74304 issue affects the Linux kernel Bluetooth hci_qca driver. In qca_setup(), hu->serdev may be NULL for hci_uart attached via non-serdev paths, yet the code unconditionally calls serdev_device_get_drvdata(hu->serdev) and dereferences it, causing a NULL pointer dereference. Th...

CVE-2026-74303

The CVE-2026-74303 issue concerns the Linux kernel Bluetooth stack (hci_qca). A NULL pointer dereference occurs in qca_dmp_hdr() when handling non-serdev devices: hu->serdev is NULL for hci_uart attached via non-serdev paths, yet the function dereferences hu->serdev->dev.driver->name....

CVE-2026-74303 Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

CVE-2026-74298

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix FRMR set pinned push error path Add destruction of FRMR handles in case the push to the pool fails. This prevents resources leak in case pool page allocation fails...

CVE-2026-74293 ASoC: fsl: fsl_audmix: Validate written enum values

In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl: fslaudmix: Validate written enum values fslaudmixputmixclksrc and fslaudmixputoutsrc convert the user-provided enum item with sndsocenumitemtoval before checking whether the item is within the enum's item count. The...

CVE-2026-74289

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't dump dying fibinfo in fibleafnotify. syzbot reported use-after-free in nsimfib4prepareevent. 0 The problem is that the following functions call fibinfohold / refcountinc while dumping fibinfo under RCU, which is...

CVE-2026-74288 net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().

In the Linux kernel, the following vulnerability has been resolved: net: fibrules: Don't dump dying fibrule in fibrulesdump. rockerrouterfibevent calls fibruleget during RCU dump. If the fibrule is dying, refcountinc will complain about it. Let's call refcountincnotzero in fibrulesdump...

EUVD-2026-59435

In the Linux kernel, the following vulnerability has been resolved: net: fibrules: Don't dump dying fibrule in fibrulesdump. rockerrouterfibevent calls fibruleget during RCU dump. If the fibrule is dying, refcountinc will complain about it. Let's call refcountincnotzero in fibrulesdump...

CVE-2026-74288 net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().

In the Linux kernel, the following vulnerability has been resolved: net: fibrules: Don't dump dying fibrule in fibrulesdump. rockerrouterfibevent calls fibruleget during RCU dump. If the fibrule is dying, refcountinc will complain about it. Let's call refcountincnotzero in fibrulesdump...

CVE-2026-74285

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netifrxqcleanupunlease tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA...

CVE-2026-74282

In the Linux kernel vulnerability CVE-2026-74282, the TIPC stack allows an oversized CONN_ACK to cause snt_unacked to underflow. The root cause is tipc_sk_conn_proto_rcv() subtracting the peer-supplied ack count from an unsigned 16-bit snt_unacked without ensuring it does not exceed the outstandi...

CVE-2026-74282 tipc: prevent snt_unacked underflow on CONN_ACK

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent sntunacked underflow on CONNACK tipcskconnprotorcv subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter sntunacked without checking that it does not exceed the number of messages...

CVE-2026-74282 tipc: prevent snt_unacked underflow on CONN_ACK

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent sntunacked underflow on CONNACK tipcskconnprotorcv subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter sntunacked without checking that it does not exceed the number of messages...

CVE-2026-74277

In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommudmamapsg, when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment s is incorrectly assigned from the head entry sg-length...

CVE-2026-74270 handshake: Require admin permission for DONE command

In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent tlshd. ACCEPT already requires GENLADMINPERM; DONE has ...

CVE-2026-74263

The CVE affects the Linux kernel net: wwan: t7xx driver. In t7xx_port_ctrl_tx, each skb fragment is cloned and the clone is immediately used to set cloned->len; if skb_clone() fails, a NULL pointer dereference can occur. The fix checks the clone before using it and, when previous fragments are...

EUVD-2026-59410

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: check skbclone in control TX t7xxportctrltx clones each skb fragment before passing it to the port transmit path. The clone is used immediately to set cloned-len, so an skbclone failure results in a NULL pointer...

EUVD-2026-59408

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: avoid stale FIFO cells during resize sndseqfiforesize still needs to publish the replacement pool before it waits for FIFO users. A blocking sndseqread holds f-uselock while it sleeps, so concurrent senders must be abl...

CVE-2026-74261 ALSA: seq: avoid stale FIFO cells during resize

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: avoid stale FIFO cells during resize sndseqfiforesize still needs to publish the replacement pool before it waits for FIFO users. A blocking sndseqread holds f-uselock while it sleeps, so concurrent senders must be abl...