UBUNTU-CVE-2026-72058

In the Linux kernel, the following vulnerability has been resolved: net: ixp4xxhss: fix duplicate HDLC netdev allocation ixp4xxhssprobe allocates two HDLC netdevs. The first one is stored in ndev, initialized, and registered with registerhdlcdevice. The second one is stored in port-netdev and lat...

CVE-2026-74434

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpcrecvmsgoob takes a received oob message off recvmsgoobq and, if a response is needed, moves it onto the pendingoobq tree. However, only the unlink from recvmsgoob...

CVE-2026-74434

The CVE-2026-74434 issue affects the Linux kernel rxrpc path: when reading an OOB message with MSG_PEEK, rxrpc_recvmsg_oob() unlinks from recvmsg_oobq but always moves the message onto pending_oobq, risking the sk_buff rbnode linkage being overwritten. This allows the skb to be reachable from bot...

EUVD-2026-59581

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpcrecvmsgoob takes a received oob message off recvmsgoobq and, if a response is needed, moves it onto the pendingoobq tree. However, only the unlink from recvmsgoob...

CVE-2026-74434 rxrpc: Don't move a peeked OOB message onto the pending queue

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpcrecvmsgoob takes a received oob message off recvmsgoobq and, if a response is needed, moves it onto the pendingoobq tree. However, only the unlink from recvmsgoob...

CVE-2026-74434 rxrpc: Don't move a peeked OOB message onto the pending queue

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpcrecvmsgoob takes a received oob message off recvmsgoobq and, if a response is needed, moves it onto the pendingoobq tree. However, only the unlink from recvmsgoob...

CVE-2026-74431

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential infinite loop in rxrpcrecvmsg Fix the wait in rxrpcrecvmsg also take check the oob queue...

CVE-2026-74428 rxrpc: Fix double unlock in rxrpc_recvmsg()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix double unlock in rxrpcrecvmsg Fix a double unlock in rxrpcrecvmsg when dealing with OOB messages...

CVE-2026-74427

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls a...

CVE-2026-74428

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix double unlock in rxrpcrecvmsg Fix a double unlock in rxrpcrecvmsg when dealing with OOB messages...

EUVD-2026-59575

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix double unlock in rxrpcrecvmsg Fix a double unlock in rxrpcrecvmsg when dealing with OOB messages...

CVE-2026-74428

The CVE-2026-74428 entry pertains to the Linux kernel, specifically a vulnerability in rxrpc_recvmsg() where a double unlock occurs while handling OOB messages. The issue is concrete: the function path for OOB messages can unlock a resource twice, potentially leading to memory corruption or simil...

CVE-2026-74428 rxrpc: Fix double unlock in rxrpc_recvmsg()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix double unlock in rxrpcrecvmsg Fix a double unlock in rxrpcrecvmsg when dealing with OOB messages...

CVE-2026-74424

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vcdata fbconnewmodelist runs when a framebuffer's modelist changes. For each console mapped to it with fbdisplayi.mode set, it reads vcconsi.d and passes the vcnum to...

CVE-2026-74419

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Adjust size for copytouser The amount of data returned to user space should be limited by the buffer size provided by the application. If the buffer is smaller than the data size, return only the portion that fits...

CVE-2026-74418

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Fix potential tracepoint null pointer dereferences Tracedmafencesignaled, tracedmafencewaitend and tracedmafencedestroy can all currently dereference a null fence-ops pointer after it has been reset on fence signalling...

CVE-2026-74416

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix memory leak in radeonringrestore on lock failure radeonringrestore takes ownership of the data buffer allocated by radeonringbackup. The caller radeongpureset only frees it in the non-restore branch; in the restor...

CVE-2026-74409

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware macid in link lookup The macid field in RX descriptors is 8 bits wide 0-255, but assoclinkonmacid has only RTW89MAXMACIDNUM 128 entries. While the driver currently assigns macid values...

CVE-2026-74400

In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpfset|removedentryxattr for negative dentries bpfsetdentryxattr and bpfremovedentryxattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passe...

CVE-2026-74388

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data The OSS sequencer processes the input MIDI bytes into a sequencer event to be dispatched later in sndseqossmidiputc called from sndseqossprocessevent. When it's ...