CVE-2026-74707

In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata...

CVE-2026-74731

In the Linux kernel, the following vulnerability has been resolved: schedext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scxlinksched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs th...

CVE-2026-74655

In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: fix TX DMA buffer flush When transmit flushing a qcom-geni UART during an ongoing TX DMA, the UART gets stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uartops does not provide a flushbuffer...

CVE-2026-74617

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs-lock in dibsdevalloc dibs-lock is initialised by dibsdevadd, but a dibs device can already take interrupts before that call: ismprobe runs ismdevinit, and hence requestirq, before it calls dibsdevadd. No...

CVE-2026-74695

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfflowtable: drop existing skb dst before skbdstsetnoref Incoming skbs passing through netfilter flowtable offload hooks or XFRM offload path might already carry a ref-counted dstentry assigned during earlier RX or...

CVE-2026-74629

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmbclientidarr A dibs device interrupt handler can be active after dibsdevdel and may still access dmbclientidarr. UAF In case of a failure in dibsdevadd being called by dibslodevprobe dmbclientidarr ...

CVE-2026-74639

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: re-anchor capture URBs on resubmission captureurbcomplete resubmits each capture URB without anchoring it: usbgeturburb; ret = usbsubmiturburb, GFPATOMIC; Anchoring is a property of a submission, not of the URB...

CVE-2026-74687

In the Linux kernel, the following vulnerability has been resolved: watchdog: at91sam9wdt: prevent timer rearm during teardown at91ping rearms the watchdog timer from its callback. timerdelete neither waits for a running callback nor prevents it from rearming the timer, so probe failure or driver...

CVE-2026-74674

In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zappterange reclaims a page table, it does: ptefreetlbtlb, pmdpgtablepmdval, addr; and this is unconditionally wrong: if this code executes, addr always points one...

CVE-2026-74608

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifstryaddingchannels cifstryaddingchannels takes a temporary reference to an interface before dropping ifacelock. If cifssesaddchannel fails, it drops that reference and then increments...

CVE-2026-74632

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: fix hugezeropfn race Patch series "mm/hugememory: fix hugezeropfn race", v2. There is a subtle race in the reference-counted hugezerofolio implementation. The fast path atomic logic fails to account for the fact th...

CVE-2026-74665

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, bpfprogrungenericxdp copies xdpfragssize back to...

CVE-2026-74634

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ringbuffersubbuforderset frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rbadvanceite...

CVE-2026-74595

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscryptioctlsetpolicy fscryptioctlsetpolicy calls inodeownerorcapable with &nopmntidmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioc...

CVE-2026-74706

In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocation of auxrdev fails during auxiliary device setup, the error path calls auxiliarydeviceuninit, which eventually invokes bngeauxdevrelease. The release callback...

CVE-2026-74645

In the Linux kernel, the following vulnerability has been resolved: mm/damon/lrusort: error out for 10000 activemembp damosquotascore can trigger division by zero if the target value is zero. DAMONLRUSORT lets users set the target value for the hot memory scheme via activemembp parameter. It avoi...

CVE-2026-74698

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix BQL reset on SQ re-activation mlx5equeuestart deactivates and re-activates all channels but closes only the queue being restarted. mlx5eactivatetxqsq then unconditionally calls netdevtxresetqueue, zeroing the BQL...

CVE-2026-74728

In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL baddr in xfsbuffree When xfsbufallocbackingmem fails, xfsbuffree is called with bp-baddr still NULL. The code falls through to the folioput path which calls virttofolioNULL, dereferencing an invalid address and...

CVE-2026-74600

In the Linux kernel, the following vulnerability has been resolved: mm/pagetablecheck: skip special zero mappings pagetablecheckset and pagetablecheckclear account mappings based on PageAnon. Shared zero-page PTEs and huge zero PMDs are special mappings, but pagetablecheck can still account them ...

CVE-2026-74708

In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsktxmetadata. Reject the request when the registered metadata area does not contain the complete field. Snapshot the...