CVE-2026-74503

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRVTIMERIFLGDEAD once the close completes sndtimercloselocked marks an instance with SNDRVTIMERIFLGDEAD and returns early when the flag is already set, but the flag is never cleared again. A completed close...

CVE-2026-74498

CVE-2026-74498 affects the Linux kernel ALSA USB-audio driver. The vulnerability arises from DMA buffer sizing for full-packet transfers: when fill_max is set, data_ep_set_params() promotes ep->curpacksize to ep->maxpacksize, but maxsize remains the original value derived from the sample ra...

EUVD-2026-59691

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fillmax is set When a USB audio endpoint requests full packet transfers via the fillmax descriptor flag, dataepsetparams promotes ep-curpacksize to ep-maxpacksize. However,...

CVE-2026-74498 ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fillmax is set When a USB audio endpoint requests full packet transfers via the fillmax descriptor flag, dataepsetparams promotes ep-curpacksize to ep-maxpacksize. However,...

CVE-2026-72489

In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvecrxcompleted In nvecrxcompleted, when an incomplete RX transfer is detected, nvecmsgfree is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately aft...

UBUNTU-CVE-2026-72494

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Replace waitqueue and flag with completion The driver previously used a waitqueue along with an explicit requestdone flag, but without proper barriers around requestdone. An earlier patch by Gui-Dong Han attempted to...

CVE-2026-72371

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFSVOLUMERMTREE is set on Fix afsinsertvolumeintocell to set AFSVOLUMERMTREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volume to be...

CVE-2026-72489

In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvecrxcompleted In nvecrxcompleted, when an incomplete RX transfer is detected, nvecmsgfree is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately aft...

UBUNTU-CVE-2026-74308

In the Linux kernel, the following vulnerability has been resolved: ext4: fix kernel BUG in ext4writeinlinedataend When the data=journal mount option is used, the ext4journalledwriteend function incorrectly calls ext4writeinlinedataend without checking if the EXT4STATEMAYINLINEDATA flag is still...

CVE-2026-72080

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix use-after-free during unmount During unmount or failure teardown all mondata structures that contain monitoring event file private data are freed after which kernfs nodes are removed. However, the RDTDELETED flag ...

CVE-2026-72080

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix use-after-free during unmount During unmount or failure teardown all mondata structures that contain monitoring event file private data are freed after which kernfs nodes are removed. However, the RDTDELETED flag ...

CVE-2026-74346

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev//patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating...

CVE-2026-74308

Summary: CVE-2026-74308 affects the Linux kernel ext4 in the data=journal scenario. The bug was that ext4_journalled_write_end() could call ext4_write_inline_data_end() without verifying EXT4_STATE_MAY_INLINE_DATA, if a prior inline data conversion failed. This could leave i_inline_size unexpande...

EUVD-2026-59455

In the Linux kernel, the following vulnerability has been resolved: ext4: fix kernel BUG in ext4writeinlinedataend When the data=journal mount option is used, the ext4journalledwriteend function incorrectly calls ext4writeinlinedataend without checking if the EXT4STATEMAYINLINEDATA flag is still...

CVE-2026-72489

The CVE-2026-72489 issue affects the Linux kernel staging/nvec code. In nvec_rx_completed(), an incomplete RX transfer could trigger nvec_msg_free() to clear a pool slot, after which the code reads nvec->rx->data[0]. Because the slot may be reallocated concurrently, this leads to a use-afte...

CVE-2026-72489 staging: nvec: fix use-after-free in nvec_rx_completed()

In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvecrxcompleted In nvecrxcompleted, when an incomplete RX transfer is detected, nvecmsgfree is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately aft...

CVE-2026-72121

CVE-2026-72121 describes a Linux kernel CAN subsystem vulnerability in which KCSAN detected a race condition updating timer and filter state during CAN message handling. The fix introduces a per-operation bcm_rx_update_lock to serialize updates to timer values (ival1/ival2/kt_ival1/kt_ival2/kt_la...

CVE-2026-72080 fs/resctrl: Fix use-after-free during unmount

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix use-after-free during unmount During unmount or failure teardown all mondata structures that contain monitoring event file private data are freed after which kernfs nodes are removed. However, the RDTDELETED flag ...

CVE-2026-72063 gpio: tegra: do not call pinctrl for GPIO direction

In the Linux kernel, the following vulnerability has been resolved: gpio: tegra: do not call pinctrl for GPIO direction tegragpiodirectioninput and tegragpiodirectionoutput already program the GPIO controller direction registers directly. The additional pinctrlgpiodirectioninput/output calls do n...

PT-2026-72677

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the nvec rx completed function. When an incomplete RX transfer is detected, the nvec msg free function is called to return the message to the pool by...