CVE-2026-74270 handshake: Require admin permission for DONE command

In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent tlshd. ACCEPT already requires GENLADMINPERM; DONE has ...

CVE-2026-74271

CVE-2026-74271 affects the Linux kernel’s power supply core. If the device tree property power-supplies has multiple values, accessing psy->supplied_from[i-1] in __power_supply_populate_supplied_from can overrun the supplied_from array. The patch fixes supplied_from allocations to prevent the ...

CVE-2026-74270

The CVE-2026-74270 vulnerability affects the Linux kernel handling of the handshake genl family. The DONE downcall previously performed no privilege check, allowing an unprivileged process that could observe or guess a valid socket to submit DONE with HANDSHAKE_A_DONE_STATUS == 0, causing the ker...

EUVD-2026-59417

In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent tlshd. ACCEPT already requires GENLADMINPERM; DONE has ...

CVE-2026-74271

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: fix suppliedfrom allocations If dts property power-supplies has multiple values, then accessing to psy-suppliedfromi-1 in powersupplypopulatesuppliedfrom will overrun suppliedfrom array...

CVE-2026-74271 power: supply: core: fix supplied_from allocations

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: fix suppliedfrom allocations If dts property power-supplies has multiple values, then accessing to psy-suppliedfromi-1 in powersupplypopulatesuppliedfrom will overrun suppliedfrom array...

CVE-2026-74270

In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent tlshd. ACCEPT already requires GENLADMINPERM; DONE has ...

CVE-2026-74271 power: supply: core: fix supplied_from allocations

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: fix suppliedfrom allocations If dts property power-supplies has multiple values, then accessing to psy-suppliedfromi-1 in powersupplypopulatesuppliedfrom will overrun suppliedfrom array...

CVE-2026-74269 bnxt: fix head underflow on XDP head-grow

In the Linux kernel, the following vulnerability has been resolved: bnxt: fix head underflow on XDP head-grow The xdp.py test testxdpnativeadjstheadgrowdata crashes when run on a bnxt machine and also crashes in NIPA. It seems that the bug is an underflow in bnxtrxmultipageskb, which builds the s...

CVE-2026-74269

In the Linux kernel, the following vulnerability has been resolved: bnxt: fix head underflow on XDP head-grow The xdp.py test testxdpnativeadjstheadgrowdata crashes when run on a bnxt machine and also crashes in NIPA. It seems that the bug is an underflow in bnxtrxmultipageskb, which builds the s...

CVE-2026-74269 bnxt: fix head underflow on XDP head-grow

In the Linux kernel, the following vulnerability has been resolved: bnxt: fix head underflow on XDP head-grow The xdp.py test testxdpnativeadjstheadgrowdata crashes when run on a bnxt machine and also crashes in NIPA. It seems that the bug is an underflow in bnxtrxmultipageskb, which builds the s...

EUVD-2026-59416

In the Linux kernel, the following vulnerability has been resolved: bnxt: fix head underflow on XDP head-grow The xdp.py test testxdpnativeadjstheadgrowdata crashes when run on a bnxt machine and also crashes in NIPA. It seems that the bug is an underflow in bnxtrxmultipageskb, which builds the s...

CVE-2026-74269

CVE-2026-74269 describes a Linux kernel issue where bnxt RX path under XDP head-grow can underflow the skb head when the head is adjusted by -256. The root cause is an underflow in bnxt_rx_multi_page_skb that builds the skb with napi_build_skb(data_ptr - bp->rx_offset, rxr->rx_page_size); b...

CVE-2026-74268

In the Linux kernel, the following vulnerability has been resolved: tcp: clear sockops cb flags before force-closing a child socket A child socket inherits the listener's bpfsockopscbflags via skclonelock. If its setup fails in tcpv4synrecvsock / tcpv6synrecvsock, the child is freed through...

CVE-2026-74267 net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcodel: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever codel drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog before i...

CVE-2026-74268 tcp: clear sock_ops cb flags before force-closing a child socket

In the Linux kernel, the following vulnerability has been resolved: tcp: clear sockops cb flags before force-closing a child socket A child socket inherits the listener's bpfsockopscbflags via skclonelock. If its setup fails in tcpv4synrecvsock / tcpv6synrecvsock, the child is freed through...

CVE-2026-74268

This CVE describes a Linux kernel vulnerability where a child socket can inherit BPF sock_ops cb flags from the listener through sk_clone_lock(), leading to a crash or compromised handling if its setup fails in tcp_v4_syn_recv_sock() or tcp_v6_syn_recv_sock(). The root cause is that, on forced-cl...

EUVD-2026-59414

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcodel: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever codel drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog before i...

CVE-2026-74268 tcp: clear sock_ops cb flags before force-closing a child socket

In the Linux kernel, the following vulnerability has been resolved: tcp: clear sockops cb flags before force-closing a child socket A child socket inherits the listener's bpfsockopscbflags via skclonelock. If its setup fails in tcpv4synrecvsock / tcpv6synrecvsock, the child is freed through...

CVE-2026-74267 net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcodel: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever codel drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog before i...