CVE-2026-74577

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtmtos in mplsgetroute mplsgetroute builds the RTMNEWROUTE reply to an RTMGETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed allocskbNLMSGGOODSIZE, .... It sets...

CVE-2026-74577 net: mpls: initialize rtm_tos in mpls_getroute()

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtmtos in mplsgetroute mplsgetroute builds the RTMNEWROUTE reply to an RTMGETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed allocskbNLMSGGOODSIZE, .... It sets...

CVE-2026-74577 net: mpls: initialize rtm_tos in mpls_getroute()

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtmtos in mplsgetroute mplsgetroute builds the RTMNEWROUTE reply to an RTMGETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed allocskbNLMSGGOODSIZE, .... It sets...

CVE-2026-74577

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtmtos in mplsgetroute mplsgetroute builds the RTMNEWROUTE reply to an RTMGETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed allocskbNLMSGGOODSIZE, .... It sets...

CVE-2026-74577

CVE-2026-74577 applies to the Linux kernel’s MPLS netlink path. A construction of RTM_NEWROUTE replies for RTM_GETROUTE could leak an uninitialized byte from the rtmsg header when rtm_tos was not zeroed, due to missing initialization in mpls_getroute(); the code filled most fields but left rtm_to...

CVE-2026-74575 thunderbolt: Prevent XDomain delayed work use-after-free on disconnect

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tbxdphandlerequest runs on systemwq and queues xd-statework via queuedelayedwork in three request handlers: PROPERTIESCHANGEDREQUEST, UUIDREQUEST via...

CVE-2026-74576

Summary of CVE-2026-74576 (Linux kernel) : The vulnerability stems from the slab allocator allowing unbounded recursion in the free path due to cycles formed when obj_exts arrays are allocated across KMALLOC_NORMAL caches. Specifically, slabs can form a cycle by allocating each other’s obj_exts a...

CVE-2026-74575

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tbxdphandlerequest runs on systemwq and queues xd-statework via queuedelayedwork in three request handlers: PROPERTIESCHANGEDREQUEST, UUIDREQUEST via...

CVE-2026-74576

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobjext array from its own slab" avoided recursive allocation of objexts from kmalloc caches of the same...

CVE-2026-74576

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobjext array from its own slab" avoided recursive allocation of objexts from kmalloc caches of the same...

CVE-2026-74576 mm/slab: prevent unbounded recursion in free path with new kmalloc type

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobjext array from its own slab" avoided recursive allocation of objexts from kmalloc caches of the same...

EUVD-2026-59640

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tbxdphandlerequest runs on systemwq and queues xd-statework via queuedelayedwork in three request handlers: PROPERTIESCHANGEDREQUEST, UUIDREQUEST via...

EUVD-2026-59641

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobjext array from its own slab" avoided recursive allocation of objexts from kmalloc caches of the same...

CVE-2026-74575 thunderbolt: Prevent XDomain delayed work use-after-free on disconnect

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tbxdphandlerequest runs on systemwq and queues xd-statework via queuedelayedwork in three request handlers: PROPERTIESCHANGEDREQUEST, UUIDREQUEST via...

CVE-2026-74575

CVE-2026-74575 : The Linux kernel Thunderbolt XDomain use-after-free on disconnect has been addressed. The fix adds a new xd->removing flag protected by xd->lock and uses it in tb_xdomain_remove() to coordinate with queue_delayed_work() sites. This ensures proper serialization between the r...

CVE-2026-74574 dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix fdev setup failure cleanup in idxdcdevopen The faileddevadd and faileddevname paths drop the file-device reference while wq-wqlock is still held. If putdevicefdev drops the last reference, idxdfiledevrelease...

EUVD-2026-59639

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix fdev setup failure cleanup in idxdcdevopen The faileddevadd and faileddevname paths drop the file-device reference while wq-wqlock is still held. If putdevicefdev drops the last reference, idxdfiledevrelease...

CVE-2026-74574 dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix fdev setup failure cleanup in idxdcdevopen The faileddevadd and faileddevname paths drop the file-device reference while wq-wqlock is still held. If putdevicefdev drops the last reference, idxdfiledevrelease...

CVE-2026-74574

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix fdev setup failure cleanup in idxdcdevopen The faileddevadd and faileddevname paths drop the file-device reference while wq-wqlock is still held. If putdevicefdev drops the last reference, idxdfiledevrelease...

CVE-2026-74574

CVE-2026-74574 affects the Linux kernel’s dmaengine idxd open path, where error paths in fdev setup could deadlock by dropping the file-device reference while wq->wq_lock is held and then re-acquiring it during release. The description explains that failed_dev_add/failed_dev_name paths drop re...