CVE-2026-74585

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound the DROM dual link port number before indexing sw-ports tbdromparseentryport validates the device-supplied header-index against sw-config.maxportnumber before indexing sw-ports, but the sibling field...

AZL-97232 CVE-2026-74588 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk-transport in step with the list it is queued on sctpoutqflushrtx moves a gap-acked chunk onto another transport's transmitted list without updating chunk-transport: if chunk-tsngapacked...

CVE-2026-74588

In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk-transport in step with the list it is queued on sctpoutqflushrtx moves a gap-acked chunk onto another transport's transmitted list without updating chunk-transport: if chunk-tsngapacked...

CVE-2026-74586

In the Linux kernel, the following vulnerability has been resolved: sctp: clear newtransport when removing a peer sctpprocessasconfparam stores a newly added peer transport in asoc-newtransport. After all parameters in the ASCONF chunk have been processed, sctpsfdoasconf uses this pointer to send...

CVE-2026-74733 gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

CVE-2026-74733

A race condition in the Linux kernel's gpio: pca953x driver (managing PCA953x GPIO expanders) allows concurrent threads to access hardware registers without proper locking. The function pca953x_irq_bus_sync_unlock() performed regmap read/write operations without holding the driver's i2c_lock , wh...

CVE-2026-74733

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

EUVD-2026-64420

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

CVE-2026-74733 gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

CVE-2026-74732

CVE-2026-74732 is a NULL pointer dereference in the Linux kernel's drm/amd/display driver, specifically in the dce110_set_avmute function. Some older DCE timing generators do not implement is_tg_enabled in their ops table. Calling this function unconditionally when waiting for AV mute frames trig...

EUVD-2026-64418

In the Linux kernel, the following vulnerability has been resolved: schedext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scxlinksched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs th...

CVE-2026-74731 sched_ext: Skip sub-disable teardown for never-linked sub-schedulers

In the Linux kernel, the following vulnerability has been resolved: schedext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scxlinksched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs th...

CVE-2026-74731

CVE-2026-74731 is a use-after-free vulnerability in the Linux kernel's sched_ext (extensible scheduler) component. When a sub-scheduler enable fails before scx_link_sched() links it into the hierarchy, the cleanup path still runs the full scx_sub_disable(). This creates a race against root disabl...

CVE-2026-74732

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check for tg ops in dce110setavmute Some older DCE timing generators do not implement istgenabled in their ops table. Calling it unconditionally when waiting for AV mute frames causes a NULL pointer dereference o...

CVE-2026-74731

In the Linux kernel, the following vulnerability has been resolved: schedext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scxlinksched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs th...

CVE-2026-74732 drm/amd/display: Check for tg ops in dce110_set_avmute

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check for tg ops in dce110setavmute Some older DCE timing generators do not implement istgenabled in their ops table. Calling it unconditionally when waiting for AV mute frames causes a NULL pointer dereference o...

EUVD-2026-64419

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check for tg ops in dce110setavmute Some older DCE timing generators do not implement istgenabled in their ops table. Calling it unconditionally when waiting for AV mute frames causes a NULL pointer dereference o...

CVE-2026-74731 sched_ext: Skip sub-disable teardown for never-linked sub-schedulers

In the Linux kernel, the following vulnerability has been resolved: schedext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scxlinksched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs th...

CVE-2026-74732 drm/amd/display: Check for tg ops in dce110_set_avmute

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check for tg ops in dce110setavmute Some older DCE timing generators do not implement istgenabled in their ops table. Calling it unconditionally when waiting for AV mute frames causes a NULL pointer dereference o...

CVE-2026-74730 NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfsserver' during a FREESTATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREESTATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct...