EUVD-2026-59650

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif-dev is on...

CVE-2026-74457

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif-dev is on...

CVE-2026-74408

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...

CVE-2026-74409

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware macid in link lookup The macid field in RX descriptors is 8 bits wide 0-255, but assoclinkonmacid has only RTW89MAXMACIDNUM 128 entries. While the driver currently assigns macid values...

CVE-2026-74296

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Free the UAR index returned by the hardware...

CVE-2026-74280

In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sgcleanup path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

CVE-2026-72295

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate irqchip index in irqfd routing Sashiko reported that the irqchip index is not validated for LoongArch. Add validation and reject out-of-range irqchip indexes to avoid indexing past the routing table's chi...

CVE-2026-72427

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix effective prog array index with BPFFPREORDER replaceeffectiveprog and purgeeffectiveprogs located the slot in the effective array by walking the program hlist and counting entries linearly. That count does not match the...

CVE-2026-72295

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate irqchip index in irqfd routing Sashiko reported that the irqchip index is not validated for LoongArch. Add validation and reject out-of-range irqchip indexes to avoid indexing past the routing table's chi...

CVE-2026-74312

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: validate virtqueue index in mmap and fault paths vhostvdpammap and vhostvdpafault use vma-vmpgoff as a virtqueue index for getvqnotification, but they do not validate that the index is smaller than v-nvqs. The ioctl...

CVE-2026-74279

In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sgcleanup error path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

UBUNTU-CVE-2026-74275

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix out-of-bounds access in cxlcancelautoattach In cxlcancelautoattach, it assumes cxled-pos is a valid index for accessing p-targets. However, cxled-pos can be set to negative errno in cxlregionsorttargets if...

UBUNTU-CVE-2026-72295

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate irqchip index in irqfd routing Sashiko reported that the irqchip index is not validated for LoongArch. Add validation and reject out-of-range irqchip indexes to avoid indexing past the routing table's chi...

CVE-2026-72428

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack slot index in nospec checks checkstackwritefixedoff computes the byte slot for a fixed-offset stack write as -off - 1, and records each written byte in slottype with slot - i % BPFREGSIZE. The Spectre v4 sanitizati...

CVE-2026-74280

In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sgcleanup path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

CVE-2026-74296

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Free the UAR index returned by the hardware...

CVE-2026-74275

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix out-of-bounds access in cxlcancelautoattach In cxlcancelautoattach, it assumes cxled-pos is a valid index for accessing p-targets. However, cxled-pos can be set to negative errno in cxlregionsorttargets if...

UBUNTU-CVE-2026-74279

In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sgcleanup error path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

UBUNTU-CVE-2026-74296

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Free the UAR index returned by the hardware...

UBUNTU-CVE-2026-74280

In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sgcleanup path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...