CVE-2026-74515 KVM: s390: pci: Reject adapter interrupt forwarding if already enabled

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled The MPCIFC instruction doesn't allow registering adapter interrupts without first unregistering. So reject any request to enable interrupt forwarding if its...

CVE-2026-74515

CVE-2026-74515 concerns the Linux kernel, specifically KVM on s390 for PCI (zPCI). The issue arises when enabling adapter interrupt forwarding: the MPCIFC instruction forbids registering interrupts without unregistering first, so a second or repeated enable request for the same device is rejected...

CVE-2026-74467

CVE-2026-74467 concerns the Linux kernel: the s390/qeth code failed to enforce CAP_NET_ADMIN for private ioctl commands (SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, SIOC_QETH_QUERY_OAT). The vulnerability is mitigated by gating these SIOCDEVPRIVATE ioctls with a CAP_NET_ADMIN check t...

EUVD-2026-59660

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Check CAPNETADMIN for private ioctls Gate the SIOCDEVPRIVATE ioctl commands SIOCQETHADPSETSNMPCONTROL, SIOCQETHGETCARDTYPE and SIOCQETHQUERYOAT with CAPNETADMIN capable check to ensure unprivileged users cannot invoke...

CVE-2026-74466 s390/zcrypt: Close speculative mem read possibility

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

CVE-2026-74467

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Check CAPNETADMIN for private ioctls Gate the SIOCDEVPRIVATE ioctl commands SIOCQETHADPSETSNMPCONTROL, SIOCQETHGETCARDTYPE and SIOCQETHQUERYOAT with CAPNETADMIN capable check to ensure unprivileged users cannot invoke...

CVE-2026-74467 s390/qeth: Check CAP_NET_ADMIN for private ioctls

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Check CAPNETADMIN for private ioctls Gate the SIOCDEVPRIVATE ioctl commands SIOCQETHADPSETSNMPCONTROL, SIOCQETHGETCARDTYPE and SIOCQETHQUERYOAT with CAPNETADMIN capable check to ensure unprivileged users cannot invoke...

CVE-2026-74467 s390/qeth: Check CAP_NET_ADMIN for private ioctls

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Check CAPNETADMIN for private ioctls Gate the SIOCDEVPRIVATE ioctl commands SIOCQETHADPSETSNMPCONTROL, SIOCQETHGETCARDTYPE and SIOCQETHQUERYOAT with CAPNETADMIN capable check to ensure unprivileged users cannot invoke...

CVE-2026-74466 s390/zcrypt: Close speculative mem read possibility

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

EUVD-2026-59659

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

CVE-2026-74440 drm/xe: Wait on external BO kernel fences in exec IOCTL

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xeexecioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, b...

CVE-2026-74440

Summary: CVE-2026-74440 affects Linux kernel DRM/XE, where a user job could race with kernel operations on external buffer objects (BOs) due to an incomplete dependency model. Root cause: during xe_exec_ioctl(), only the VM’s dma-resv KERNEL slot was added as a dependency, omitting external BOs (...

CVE-2026-74440

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xeexecioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, b...

CVE-2026-74440 drm/xe: Wait on external BO kernel fences in exec IOCTL

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xeexecioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, b...

CVE-2026-72311

In the Linux kernel, the following vulnerability has been resolved: drm/xe: free madvise VMA array on L2 flush failure xevmmadviseioctl allocates madviserange.vmas in getvmas. After getvmas succeeds with at least one VMA, error paths must go through freevmas so the array is released before the...

CVE-2026-72311

In the Linux kernel, the following vulnerability has been resolved: drm/xe: free madvise VMA array on L2 flush failure xevmmadviseioctl allocates madviserange.vmas in getvmas. After getvmas succeeds with at least one VMA, error paths must go through freevmas so the array is released before the...

UBUNTU-CVE-2026-74307

In the Linux kernel, the following vulnerability has been resolved: ext4: validate donor file superblock early in EXT4IOCMOVEEXT Reject the EXT4IOCMOVEEXT ioctl early if the donor file does not belong to the same superblock as the original file. Currently, this validation is performed inside...

UBUNTU-CVE-2026-72311

In the Linux kernel, the following vulnerability has been resolved: drm/xe: free madvise VMA array on L2 flush failure xevmmadviseioctl allocates madviserange.vmas in getvmas. After getvmas succeeds with at least one VMA, error paths must go through freevmas so the array is released before the...

CVE-2026-72482

In the Linux kernel, the following vulnerability has been resolved: gpib: fix double decrement of descriptorbusy in commandioctl commit d1857f8296dc "gpib: fix use-after-free in IO ioctl handlers" introduced a descriptorbusy reference counter to pin struct gpibdescriptor across IO ioctl operation...

CVE-2026-72310

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2ioctlqueryinfo validates the PASSTHRUFSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bounds...