CVE-2026-74411

The CVE affects the Linux kernel with the wifi driver rtw89 (rtw89_core). The vulnerability arises in the 6 GHz scan path where the 6GHz channel-list scan loop uses an incorrect data type for the scan index, leading to an infinite/long loop and a soft lockup (CPU stuck for ~26s) during wifi scans...

EUVD-2026-59558

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89hwscanaddchanax for over 20 seconds, leading to a system...

CVE-2026-74411 wifi: rtw89: Correct data type for scan index to avoid infinite loop

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89hwscanaddchanax for over 20 seconds, leading to a system...

CVE-2026-74276

Summary : CVE-2026-74276 documents a Linux kernel SPI/Xilinx driver issue where the TX FIFO size was miscomputed due to querying FULL and relying on the TX FIFO to reflect the actual buffer, ignoring the shift register. The result can be an over-read (example: 17 bytes for a 16-byte FIFO) leading...

CVE-2026-74276 spi: xilinx: use FIFO occupancy register to determine buffer size

In the Linux kernel, the following vulnerability has been resolved: spi: xilinx: use FIFO occupancy register to determine buffer size The method the driver uses to determine the size of the FIFO has a problem. What it currently does is this: It stops the SPI hardware and writes to the TX FIFO...

EUVD-2026-59423

In the Linux kernel, the following vulnerability has been resolved: spi: xilinx: use FIFO occupancy register to determine buffer size The method the driver uses to determine the size of the FIFO has a problem. What it currently does is this: It stops the SPI hardware and writes to the TX FIFO...

CVE-2026-72330 net/tls: Consume empty data records in tls_sw_read_sock()

In the Linux kernel, the following vulnerability has been resolved: net/tls: Consume empty data records in tlsswreadsock A peer may send a zero-length TLS applicationdata record; TLS 1.3 explicitly permits these as a traffic-analysis countermeasure RFC 8446, Section 5.1. After decryption such a...

CVE-2026-72193 ntfs3: cap RESTART_TABLE free-chain walker at rt->used

In the Linux kernel, the following vulnerability has been resolved: ntfs3: cap RESTARTTABLE free-chain walker at rt-used A crafted NTFS3 disk image triggers an in-kernel infinite loop at mount time, hanging the mounting thread and firing the soft-lockup watchdog within 22s on multi-CPU hosts pani...

CVE-2026-72193

CVE-2026-72193 concerns the in-tree ntfs3 kernel driver. A crafted NTFS3 disk image could trigger an in-kernel infinite loop during mount via a corrupted RESTART_TABLE free-chain, hanging the mounting thread and potentially invoking the soft-lockup watchdog on multi-CPU systems. The vulnerability...

CVE-2026-72166 net/9p: fix infinite loop in p9_client_rpc on fatal signal

In the Linux kernel, the following vulnerability has been resolved: net/9p: fix infinite loop in p9clientrpc on fatal signal When p9clientrpc is called with type P9TFLUSH and the transport has no peer e.g. fd transport backed by pipes with no 9p server, a fatal signal causes an infinite loop:...

EUVD-2026-58924

In the Linux kernel, the following vulnerability has been resolved: net/9p: fix infinite loop in p9clientrpc on fatal signal When p9clientrpc is called with type P9TFLUSH and the transport has no peer e.g. fd transport backed by pipes with no 9p server, a fatal signal causes an infinite loop:...

CVE-2026-72166

CVE-2026-72166 affects the Linux kernel’s 9p client RPC path. In p9_client_rpc() when handling P9_TFLUSH, a fatal signal could cause an infinite loop if the transport has no peer, due to clearing TIF_SIGPENDING before rechecking signal_pending_state. The fix adds a check for fatal_signal_pending(...

CVE-2026-72089 accel/ivpu: Reject firmware log with size smaller than header

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fwlogfrombo validates the tracing buffer headersize and that the log fits within the BO, but never checks that log-size is at least log-headersize. fwlogprintbuffer th...

CVE-2026-72029 net: wwan: iosm: bound device offsets in the MUX downlink decoder

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: bound device offsets in the MUX downlink decoder muxdladbdecode walks a chain of aggregated datagram tables using offsets and lengths taken from the modem. firsttableindex, nexttableindex, tablelength,...

EUVD-2026-58987

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: bound device offsets in the MUX downlink decoder muxdladbdecode walks a chain of aggregated datagram tables using offsets and lengths taken from the modem. firsttableindex, nexttableindex, tablelength,...

PT-2026-72354

In the Linux kernel, the following vulnerability has been resolved: net/9p: fix infinite loop in p9 client rpc on fatal signal When p9 client rpc is called with type P9 TFLUSH and the transport has no peer e.g. fd transport backed by pipes with no 9p server, a fatal signal causes an infinite loop...

PT-2026-72381

In the Linux kernel, the following vulnerability has been resolved: ntfs3: cap RESTART TABLE free-chain walker at rt-used A crafted NTFS3 disk image triggers an in-kernel infinite loop at mount time, hanging the mounting thread and firing the soft-lockup watchdog within 22s on multi-CPU hosts pan...

PT-2026-72867

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential infinite loop in rxrpc recvmsg Fix the wait in rxrpc recvmsg also take check the oob queue...

PT-2026-72847

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89 hw scan add chan ax for over 20 seconds, leading to a...

PT-2026-72856

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Reject VMAs with VM IO or VM PFNMAP when creating SVM ranges VMAs marked with VM IO or VM PFNMAP are not backed by struct page objects, which GPUSVM requires in order to operate correctly. In particular, get pages...