CVE-2026-74661 mac802154: fix netdev use-after-free in beacon worker

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix netdev use-after-free in beacon worker mac802154beaconworker reads local-beaconreq under RCU and derives the sub-interface from the request, but then drops the RCU read lock and continues to use both sdata and the...

CVE-2026-74661

CVE-2026-74661 is a use-after-free vulnerability in the Linux kernel's mac802154 subsystem (IEEE 802.15.4 wireless). The root cause is in mac802154_beacon_worker(), which reads local->beacon_req under RCU, derives the sub-interface, then drops the RCU read lock while continuing to use sdata an...

EUVD-2026-64347

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtnflog: pin the NFLOG backend nflogunregister runs after the per-net teardown so its final RCU grace period also drains readers that obtained the logger from a per-net binding. However, ebtnflog passes an explicit UL...

CVE-2026-74660

CVE-2026-74660 is a use-after-free vulnerability in the Linux kernel's netfilter subsystem, specifically in the ebt_nflog (ebtables NFLOG target) module. The root cause is that ebt_nflog passes an explicit ULOG log type to nf_log_packet() without holding a module reference on the selected logger ...

CVE-2026-74660 netfilter: ebt_nflog: pin the NFLOG backend

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtnflog: pin the NFLOG backend nflogunregister runs after the per-net teardown so its final RCU grace period also drains readers that obtained the logger from a per-net binding. However, ebtnflog passes an explicit UL...

CVE-2026-74656 ipv4: fix use-after-free in fib_nhc_update_mtu()

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fibnhcupdatemtu fibnhcupdatemtu walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcudereferenceprotected with a constant tr...

CVE-2026-74656

CVE-2026-74656 is a use-after-free vulnerability in the Linux kernel IPv4 subsystem, specifically in fib_nhc_update_mtu(). The function walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with concurrent PMTU exception updates. The walk uses rcu_dereference_protect...

EUVD-2026-64593

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fibnhcupdatemtu fibnhcupdatemtu walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcudereferenceprotected with a constant tr...

EUVD-2026-64589

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...

CVE-2026-74652 serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...

CVE-2026-74652

This vulnerability affects the Linux kernel amba-pl011 serial driver. The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after the port is freed, because the IRQ handler can arm a timer. The fix ensures the IRQ is freed before cancelling both timers, completes the RS485...

EUVD-2026-64579

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

CVE-2026-74642

CVE-2026-74642 is a Use-After-Free (UAF) vulnerability in the Linux kernel's ALSA USB subsystem , specifically in the handling of MIDI 2.0 (UMP) endpoints . A prior fix for a UAF in ump_to_endpoint() inadvertently introduced a second UAF: the code dereferences the UMP endpoint object in a delayed...

CVE-2026-74642 ALSA: usb: Fix UAF at delayed release of MIDI2 EPs

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

EUVD-2026-64576

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: re-anchor capture URBs on resubmission captureurbcomplete resubmits each capture URB without anchoring it: usbgeturburb; ret = usbsubmiturburb, GFPATOMIC; Anchoring is a property of a submission, not of the URB...

CVE-2026-74639

CVE-2026-74639 is a use-after-free in the Linux kernel's ALSA us144mkii driver (Tascam US-144MKII USB audio interface). The root cause is that capture_urb_complete() resubmits capture URBs without re-anchoring them. Since anchoring is a property of a submission (not the URB itself), the anchor be...

CVE-2026-74639 ALSA: us144mkii: re-anchor capture URBs on resubmission

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: re-anchor capture URBs on resubmission captureurbcomplete resubmits each capture URB without anchoring it: usbgeturburb; ret = usbsubmiturburb, GFPATOMIC; Anchoring is a property of a submission, not of the URB...

CVE-2026-74637 perf/core: Fix group leader use-after-free after sibling detach

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach perfgroupdetach handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their groupleader...

EUVD-2026-64574

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach perfgroupdetach handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their groupleader...

CVE-2026-74637

CVE-2026-74637 is a use-after-free vulnerability in the Linux kernel's perf/core subsystem. When a perf event sibling is detached via DETACH_GROUP (e.g., during CPU hot-unplug), its group_leader pointer is left pointing at the old leader instead of being reset. If the leader is subsequently freed...