CVE-2026-74583 net/sched: cls_route: fix fastmap use-after-free on filter

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4filter pointers indexed by id, iif. The reader route4classify populates this cache via...

CVE-2026-74582 packet: use consistent hard_header_len in non-ring send paths

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hardheaderlen in non-ring send paths packetsnd reads dev-hardheaderlen multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through...

EUVD-2026-64002

In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq-metaiotlb caches the vhostiotlbmap that backs each vring metadata region, and iotlbaccessok returns early on a cache hit, taking the hit as proof that the region h...

EUVD-2026-64003

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6rulesuppress drops a suppressed route with ip6rtputflags, but leaves res-rt6 pointing at the released rt6info. If no later rule supplies a replacement, fib6rulelookup still sees...

CVE-2026-74580

In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq-metaiotlb caches the vhostiotlbmap that backs each vring metadata region, and iotlbaccessok returns early on a cache hit, taking the hit as proof that the region h...

CVE-2026-74581

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6rulesuppress drops a suppressed route with ip6rtputflags, but leaves res-rt6 pointing at the released rt6info. If no later rule supplies a replacement, fib6rulelookup still sees...

CVE-2026-74581 net: ipv6: clear suppressed fib6 rule result

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6rulesuppress drops a suppressed route with ip6rtputflags, but leaves res-rt6 pointing at the released rt6info. If no later rule supplies a replacement, fib6rulelookup still sees...

CVE-2026-74581 net: ipv6: clear suppressed fib6 rule result

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6rulesuppress drops a suppressed route with ip6rtputflags, but leaves res-rt6 pointing at the released rt6info. If no later rule supplies a replacement, fib6rulelookup still sees...

CVE-2026-74581

A use-after-free vulnerability in the Linux kernel 's IPv6 FIB rule lookup path. In fib6_rule_suppress(), a suppressed route is released via ip6_rt_put_flags() but the res->rt6 pointer is not cleared. If no subsequent rule provides a replacement, fib6_rule_lookup() returns the stale freed rt6_...

CVE-2026-74580 vhost: reset the vring metadata cache on vring reconfiguration

In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq-metaiotlb caches the vhostiotlbmap that backs each vring metadata region, and iotlbaccessok returns early on a cache hit, taking the hit as proof that the region h...

CVE-2026-74580

This vulnerability affects the Linux kernel's vhost subsystem . The vring metadata cache (vq->meta_iotlb[]) is not reset when VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM reconfigures a virtual queue, causing iotlb_access_ok() to return early on a stale cache hit and skip re-validation. With a ...

CVE-2026-74580 vhost: reset the vring metadata cache on vring reconfiguration

In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq-metaiotlb caches the vhostiotlbmap that backs each vring metadata region, and iotlbaccessok returns early on a cache hit, taking the hit as proof that the region h...

CVE-2026-74576

A flaw was found in the Linux kernel's memory management. This vulnerability allows for unbounded recursion in the slab free path, a process where the kernel manages and releases small blocks of memory. When certain kernel memory allocation caches kmalloc caches form a cycle during internal data...

CVE-2026-74524

A flaw was found in the Linux kernel. When performing memory hot-remove operations on systems using RISC-V architecture, an out-of-bounds page-table walk can occur. This issue arises because the system attempts to access memory outside of its designated boundaries, potentially leading to a kernel...

CVE-2026-74518

A flaw was found in the Linux kernel. The allocatefileregionentries function, responsible for managing huge page memory regions, can suffer from list corruption. This occurs because the listsplice operation does not properly re-initialize a list head, allowing concurrent access to shared memory...

RLSA-2026:57251 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: drm/amdkfd: Fix out-of-bounds write in kfdeventpageset CVE-2026-43206 kernel: drm/amdgpu: Refactor amdgpugemvaioctl for Handling Last Fence Update and Timeline Management v4 CVE-2026-4323...

CVE-2026-74444

A flaw was found in the Linux kernel's drm/vmwgfx driver. A local attacker could exploit an issue in the vmwcmddraw function by providing a specially crafted DRAWPRIMITIVES header with an undersized value. This can lead to an out-of-bounds read of kernel memory, potentially allowing for informati...

CVE-2026-74577

A flaw was found in the Linux kernel's Multiprotocol Label Switching MPLS networking component. When processing an RTMGETROUTE request, the mplsgetroute function fails to initialize a specific byte in the response message. This oversight allows a local user to obtain a single byte of uninitialize...

CVE-2026-74575

A flaw was found in the Thunderbolt XDomain driver of the Linux kernel. A race condition can occur during the removal of a Thunderbolt cross-domain device XDomain. This allows a delayed work item to be queued after its cancellation but before the XDomain object is freed, leading to a use-after-fr...

CVE-2026-74552

A flaw was found in the Linux kernel's hwmon lm90 driver. A local user can trigger a null pointer dereference by reading sysfs attributes before the driver's registration is complete. This can lead to a system crash, resulting in a denial of service...