CVE-2026-74749

CVE-2026-74749 affects the Linux kernel 's rseq (restricted sequence) subsystem. When __exit_to_user_mode_loop() invokes rseq_grant_timeslice_extension() with interrupts enabled, a granted time slice extension calls hrtimer_rearm_deferred_tif(), which in turn calls __hrtimer_rearm_deferred() — a ...

CVE-2026-74747

CVE-2026-74747 affects the Linux kernel IP Virtual Server (ipvs) subsystem. In the ip_vs_nat_icmp() function, a local process can modify the ihl (Internet Header Length) field, and after skb_ensure_writable() the kernel may see a larger value than originally validated. This leads to an out-of-bou...

CVE-2026-74746

CVE-2026-74746 affects the Linux kernel netfilter flowtable subsystem. The root cause is an ordering bug in nf_flow_table_iterate(), which treats only original-direction tuple nodes as owning entries. Publishing the original node before the reply node allows the garbage collector to observe and f...

CVE-2026-74745

CVE-2026-74745 is a deadlock vulnerability in the Linux kernel's bnxt (Broadcom NetXtreme) network driver . The root cause is that the driver takes the netdev instance lock inside an IRQ affinity notifier callback (to restart the queue) and then cancels work under the same lock, creating a self-d...

CVE-2026-74743

CVE-2026-74743 affects the Linux kernel 's macvlan network device. During macvlan_init(), macvlan devices inherit hard_header_len from the lower device but leave needed_headroom and needed_tailroom at zero. When the underlying lower device requires extra headroom or tailroom (e.g., macsec , ipsec...

CVE-2026-74744

CVE-2026-74744 affects the Linux kernel ipvlan subsystem. During initialization, ipvlan devices inherit hard_header_len from the underlying phy_dev but leave needed_headroom and needed_tailroom set to zero. When the lower device requires extra headroom or tailroom (e.g., for macsec , ipsec , wire...

CVE-2026-74742

In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer txq in vethpoll vethpoll derives the index of the peer TX queue to wake from rq-xdprxq.queueindex. That field is only initialized by xdprxqinforeg in vethenablexdprange, which runs only...

CVE-2026-74741

This vulnerability affects the ngbe network driver in the Linux kernel . In non-MSI-X mode (legacy INTx or single MSI), the wx->msix_entry pointer is never allocated or initialized. Calling NGBE_INTR_MISC(wx) then dereferences wx->msix_entry->entry, causing a NULL pointer dereference cra...

CVE-2026-74740

CVE-2026-74740 is a TOCTOU (time-of-check-time-of-use) NULL pointer dereference in the Linux kernel's net/sched: act_api subsystem. When handling TC_ACT_GOTO_CHAIN, tcf_action_exec() performs an initial rcu_access_pointer(a->goto_chain) check, then calls tcf_action_goto_chain_exec() which perf...

CVE-2026-74739

CVE-2026-74739 affects the Linux kernel's net/sched: cls_u32 traffic control classifier. The root cause is that u32_bind_class() unconditionally casts a walker handle to tc_u_knode and accesses the tcf_result member, but when the handle is actually a tc_u_hnode (which lacks that member), the resu...

CVE-2026-74738

CVE-2026-74738 affects the Linux kernel regmap sdw-mbq (SoundWire Modem Bus Queued) subsystem. The function regmap_sdw_mbq_poll_busy() dereferences ctx->readable_reg() without checking for NULL , but this callback is optional—drivers such as es9356 and tac5xx2-sdw build an MBQ regmap without s...

CVE-2026-74737

CVE-2026-74737 affects the TI am65-cpsw-nuss Ethernet driver in the Linux kernel . On the packet reception path, the helper function cppi5_desc_get_tags_ids() copies the full 16-bit Source Tag from the RX DMA Descriptor into the port_id variable. However, only the lower 8 bits of that tag encode ...

CVE-2026-74736

A vulnerability in the Linux kernel 's net/sched cls_bpf classifier allowed a device-bound (offloaded) eBPF program to be attached to a different network device than the one it was bound to. The function cls_bpf_prog_from_efd() retrieved a SCHED_CLS program via bpf_prog_get_type_dev() but never v...

CVE-2026-74735

In the Linux kernel, the following vulnerability has been resolved: l2tp: fix tunnel and session refcount leak on seqfile release In pppol2tpprocopen and l2tpdfsseqopen, iteration state pd-tunnel and pd-session is kept in seqfile private data to allow iteration across multiple read system calls...

CVE-2026-74734

A NULL pointer dereference in the Linux kernel's firewire/ohci driver can crash the kernel. During early probe failure (e.g., pcim_enable_device() or MMIO mapping failure), the devres cleanup calls ar_context_release(), which dereferences ctx->ohci before verifying the context was ever initial...

EUVD-2026-66557

The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTPMGMTTIME management id. In tlvmgmtpostrecv, the PTPMGMTTIME case casts mgmttlv-data to a 10-byte struct ptptimestamp and reads it then byte-swaps and writes it back without first checking that the TLV data...

audit-kernel

Sottosistema Audit del Kernel Linux https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git https://github.com/linux-audit/audit-kernel Il sottosistema di audit di Linux fornisce un framework di logging sicuro utilizzato per catturare e registrare eventi rilevanti per la sicurezza. È...

Moderate: Red Hat Security Advisory: pam security update

An update for pam is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module

A flaw was found in Linux-PAM's pamuserdb module. This vulnerability, categorized as an Observable Timing Discrepancy CWE-208, allows a local or network-adjacent attacker to recover plaintext passwords. By repeatedly attempting authentication and measuring response-timing differences during...

SigDigger

SigDigger - L'analizzatore di segnali digitali libero SigDigger è un analizzatore di segnali digitali libero per GNU/Linux e macOS, progettato per estrarre informazioni da segnali radio sconosciuti. Supporta una varietà di dispositivi SDR tramite SoapySDR e consente la demodulazione regolabile di...