CVE-2026-74446

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold eventmutex while checkpointing CRIU events kfdcriucheckpointevents counts the entries in p-eventidr via kfdgetnumevents, allocates an array sized to that count, and then walks the same IDR to fill it. Neither the...

CVE-2026-74448

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix QID bit leak in pqmcreatequeue When MES is enabled and amdgpuamdkfdallockernelmem fails during the first queue creation for a process, pqmcreatequeue returns early via 'return retval' without going through the...

CVE-2026-74451

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes ifacefwtocpuaddr only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interfac...

CVE-2026-74442

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: avoid destroyworkqueueNULL on vkms init failure Two paths through vmwvkmsinit can leave vmw-crcworkq NULL while still leaving the rest of the driver in a state that calls vmwvkmscleanup at module unload: 1...

CVE-2026-74441

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Fix race condition and ordering in port unregistration A synchronization issue exists during port unregistration where pending partner work items can race against workqueue destruction, leading to use-after-free...

CVE-2026-74440

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xeexecioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, b...

EUVD-2026-59642

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtmtos in mplsgetroute mplsgetroute builds the RTMNEWROUTE reply to an RTMGETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed allocskbNLMSGGOODSIZE, .... It sets...

CVE-2026-74577 net: mpls: initialize rtm_tos in mpls_getroute()

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtmtos in mplsgetroute mplsgetroute builds the RTMNEWROUTE reply to an RTMGETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed allocskbNLMSGGOODSIZE, .... It sets...

CVE-2026-74577

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtmtos in mplsgetroute mplsgetroute builds the RTMNEWROUTE reply to an RTMGETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed allocskbNLMSGGOODSIZE, .... It sets...

CVE-2026-74577 net: mpls: initialize rtm_tos in mpls_getroute()

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtmtos in mplsgetroute mplsgetroute builds the RTMNEWROUTE reply to an RTMGETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed allocskbNLMSGGOODSIZE, .... It sets...

CVE-2026-74577

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtmtos in mplsgetroute mplsgetroute builds the RTMNEWROUTE reply to an RTMGETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed allocskbNLMSGGOODSIZE, .... It sets...

CVE-2026-74577

CVE-2026-74577 applies to the Linux kernel’s MPLS netlink path. A construction of RTM_NEWROUTE replies for RTM_GETROUTE could leak an uninitialized byte from the rtmsg header when rtm_tos was not zeroed, due to missing initialization in mpls_getroute(); the code filled most fields but left rtm_to...

CVE-2026-74576 mm/slab: prevent unbounded recursion in free path with new kmalloc type

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobjext array from its own slab" avoided recursive allocation of objexts from kmalloc caches of the same...

CVE-2026-74576

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobjext array from its own slab" avoided recursive allocation of objexts from kmalloc caches of the same...

CVE-2026-74575 thunderbolt: Prevent XDomain delayed work use-after-free on disconnect

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tbxdphandlerequest runs on systemwq and queues xd-statework via queuedelayedwork in three request handlers: PROPERTIESCHANGEDREQUEST, UUIDREQUEST via...

CVE-2026-74575

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tbxdphandlerequest runs on systemwq and queues xd-statework via queuedelayedwork in three request handlers: PROPERTIESCHANGEDREQUEST, UUIDREQUEST via...

CVE-2026-74576

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobjext array from its own slab" avoided recursive allocation of objexts from kmalloc caches of the same...

CVE-2026-74576

Summary of CVE-2026-74576 (Linux kernel) : The vulnerability stems from the slab allocator allowing unbounded recursion in the free path due to cycles formed when obj_exts arrays are allocated across KMALLOC_NORMAL caches. Specifically, slabs can form a cycle by allocating each other’s obj_exts a...

EUVD-2026-59641

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobjext array from its own slab" avoided recursive allocation of objexts from kmalloc caches of the same...

EUVD-2026-59640

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tbxdphandlerequest runs on systemwq and queues xd-statework via queuedelayedwork in three request handlers: PROPERTIESCHANGEDREQUEST, UUIDREQUEST via...