EUVD-2026-59662

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sockdiag uses transportcount t...

CVE-2026-74469

The CVE-2026-74469 issue affects the Linux kernel SCTP implementation. It occurs in sctp_assoc_add_peer(), where a 16-bit transport_count is incremented for each new unique peer; once the 65,536th transport is added, the counter wraps to zero. SCTP sock_diag uses transport_count to reserve the IN...

CVE-2026-74469 sctp: prevent peer transport count overflow

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sockdiag uses transportcount t...

CVE-2026-74468 gpio: pch: use raw_spinlock_t for the register lock

In the Linux kernel, the following vulnerability has been resolved: gpio: pch: use rawspinlockt for the register lock pchirqtype is registered as the irqchip .irqsettype callback and takes chip-spinlock with spinlockirqsave. This callback is reached from setupirq - irqsettrigger - chip-irqsettype...

CVE-2026-74468

The CVE-2026-74468 vulnerability affects the Linux kernel GPIO subsystem for the pch (Platform Controller Hub) driver. The root cause is that pch_irq_type() uses a spinlock (chip->spinlock) with spin_lock_irqsave() while __irq_set_trigger() is invoked with desc->lock held (a raw_spinlock_t)...

CVE-2026-74468

In the Linux kernel, the following vulnerability has been resolved: gpio: pch: use rawspinlockt for the register lock pchirqtype is registered as the irqchip .irqsettype callback and takes chip-spinlock with spinlockirqsave. This callback is reached from setupirq - irqsettrigger - chip-irqsettype...

CVE-2026-74468 gpio: pch: use raw_spinlock_t for the register lock

In the Linux kernel, the following vulnerability has been resolved: gpio: pch: use rawspinlockt for the register lock pchirqtype is registered as the irqchip .irqsettype callback and takes chip-spinlock with spinlockirqsave. This callback is reached from setupirq - irqsettrigger - chip-irqsettype...

CVE-2026-74466

The CVE-2026-74466 vulnerability concerns the Linux kernel’s s390/zcrypt path. A domain value is extracted from a CCA or EP11 ioctl struct and, under certain conditions (custom device node, administrative load), is used as an array index after bounds checking without a speculation barrier. This c...

CVE-2026-74467

CVE-2026-74467 concerns the Linux kernel: the s390/qeth code failed to enforce CAP_NET_ADMIN for private ioctl commands (SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, SIOC_QETH_QUERY_OAT). The vulnerability is mitigated by gating these SIOCDEVPRIVATE ioctls with a CAP_NET_ADMIN check t...

CVE-2026-74466 s390/zcrypt: Close speculative mem read possibility

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

CVE-2026-74467 s390/qeth: Check CAP_NET_ADMIN for private ioctls

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Check CAPNETADMIN for private ioctls Gate the SIOCDEVPRIVATE ioctl commands SIOCQETHADPSETSNMPCONTROL, SIOCQETHGETCARDTYPE and SIOCQETHQUERYOAT with CAPNETADMIN capable check to ensure unprivileged users cannot invoke...

CVE-2026-74467 s390/qeth: Check CAP_NET_ADMIN for private ioctls

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Check CAPNETADMIN for private ioctls Gate the SIOCDEVPRIVATE ioctl commands SIOCQETHADPSETSNMPCONTROL, SIOCQETHGETCARDTYPE and SIOCQETHQUERYOAT with CAPNETADMIN capable check to ensure unprivileged users cannot invoke...

CVE-2026-74466 s390/zcrypt: Close speculative mem read possibility

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

EUVD-2026-59659

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

EUVD-2026-59658

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix potential UAF on meter attach failure While attaching a newly created meter attachmeter function makes the new meter visible to other CPUs but can still fail afterwards. On failure, it detaches the meter bac...

CVE-2026-74465

The CVE-2026-74465 entry describes a potential use-after-free in Linux kernel/Open vSwitch meter handling: attach_meter() may briefly expose a newly created meter and later free it on failure via ovs_meter_cmd_set(), risking UAF if RC reader/window timing allows access. The fix (per the reports) ...

CVE-2026-74464 net: openvswitch: fix skb leak on flow key update failure during ct

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix skb leak on flow key update failure during ct ovsctexecute always steals or frees the skb on failure while ovsflowkeyupdate does not. So, if it fails and we return right away, the skb ends up leaked. Fix tha...

CVE-2026-74463 i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock

In the Linux kernel, the following vulnerability has been resolved: i2c: jz4780: Cache host clock rate at probe to prevent CCF preparelock deadlock Fix a severe AB/BA deadlock between the Common Clock Framework CCF and the I2C adapter lock, which triggers when an I2C-controlled clock generator...

CVE-2026-74463

The CVE-2026-74463 issue concerns the Linux kernel: i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock. The root cause is that during an I2C clock frequency change, the Common Clock Framework (CCF) can deadlock with the I2C adapter lock when clk_get_rate() is invoked...

EUVD-2026-59656

In the Linux kernel, the following vulnerability has been resolved: i2c: jz4780: Cache host clock rate at probe to prevent CCF preparelock deadlock Fix a severe AB/BA deadlock between the Common Clock Framework CCF and the I2C adapter lock, which triggers when an I2C-controlled clock generator...