EUVD-2026-59685

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtyperesize copies comment pointers with memcpy, not the comment objects themselves. During the window after an entry has been copied but before the table swap a...

CVE-2026-74490

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid use-after-free in poll trace queue dumps TIPC socket tracepoints dump queue state through tipcskdump. Most queue-dump callsites already serialize that walk under the socket lock or sk-sklock.slock, but tipcpoll calls...

EUVD-2026-59677

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't let an 'F' entry pin its own instance An entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed. Any entry nobody removes by hand only gets closed once...

CVE-2026-74484

CVE-2026-74484 concerns the Linux kernel’s binfmt_misc feature: an entry registered with the character 'F' can cause the interpreter to pin itself, preventing proper unregistration and leading to a DoS with leaked resources (including user namespaces). The issue arises when the interpreter’s file...

CVE-2026-74485

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: reject a flag character as the field delimiter The registration string starts with a user chosen delimiter that separates the individual fields. So that the field parsers terminate even on a truncated string createent...

CVE-2026-74483 binfmt_misc: don't leak the user namespace when the mount fails

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't leak the user namespace when the mount fails bmgettree takes a reference to the user namespace and hands it to gettreekeyed as the sget key. sgetfc moves that reference into sb-sfsinfo and clears fc-sfsinfo, so...

CVE-2026-74483 binfmt_misc: don't leak the user namespace when the mount fails

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't leak the user namespace when the mount fails bmgettree takes a reference to the user namespace and hands it to gettreekeyed as the sget key. sgetfc moves that reference into sb-sfsinfo and clears fc-sfsinfo, so...

CVE-2026-74482

CVE-2026-74482 — Linux kernel (mm/huge_memory) . The issue arises during THP folio splitting in mm/huge_memory.c: __folio_split dereferences the mapping after the split while folios are still frozen/locked, and calls remap_page() and shmem_uncharge() before unlocking the after-split folios. This ...

CVE-2026-74483

CVE-2026-74483 affects the Linux kernel: binfmt_misc may leak a user namespace across mounts when bm_fill_super() fails. The root cause is improper ownership transfer of the user namespace through s_fs_info leading to a leak, which is mitigated by dropping the reference in kill_sb() so the namesp...

EUVD-2026-59676

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't leak the user namespace when the mount fails bmgettree takes a reference to the user namespace and hands it to gettreekeyed as the sget key. sgetfc moves that reference into sb-sfsinfo and clears fc-sfsinfo, so...

CVE-2026-74482

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: unlock immaprwsem before releasing after-split folios foliosplit keeps dereferencing the mapping after the split: shmemunchargemapping-host and remappage while the folios are still frozen/locked, and...

CVE-2026-74483

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't leak the user namespace when the mount fails bmgettree takes a reference to the user namespace and hands it to gettreekeyed as the sget key. sgetfc moves that reference into sb-sfsinfo and clears fc-sfsinfo, so...

CVE-2026-74482 mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: unlock immaprwsem before releasing after-split folios foliosplit keeps dereferencing the mapping after the split: shmemunchargemapping-host and remappage while the folios are still frozen/locked, and...

CVE-2026-74481 mm/page_reporting: use system_freezable_wq to fix UAF during suspend

In the Linux kernel, the following vulnerability has been resolved: mm/pagereporting: use systemfreezablewq to fix UAF during suspend During PM freeze e.g. S3 suspend or S4 hibernation, device drivers like virtioballoon reset their underlying virtio devices and delete their virtqueues via...

CVE-2026-74480

CVE-2026-74480 affects the Linux kernel networking bridge code. The fast-leave path in br_multicast_leave_group() can dereference a stale mp->ports entry after br_multicast_del_pg() removes a port group, enabling a scenario where multiple port groups for the same port/group with different sour...

CVE-2026-74479 net: pktgen: fix proc entry use-after-free

In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix proc entry use-after-free pktgenchangename replaces pktdev-entry while holding t-iflock. pktgenremovedevice removes the same entry before remdevfromiflist takes that lock. This allows the following interleaving:...

CVE-2026-74480

In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group brmulticastleavegroup iterates mp-ports with pp = &p-next in its fast-leave path. After brmulticastdelpg removes p, continuing the loop advances pp through the deleted entr...

CVE-2026-74478

In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vectormmsgrx When vectormmsgrx discards a packet whose overlay header fails verifyheader, it frees the skb and continues the loop: if headercheck estats.rxencapserrors++; continue; The normal and...

CVE-2026-74474

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull for transmit path header pulls In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the availability of network layer headers ARP, IPv6/ND, IP/IPv6 MDB keys...

CVE-2026-74474 vxlan: use pskb_network_may_pull() for transmit path header pulls

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull for transmit path header pulls In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the availability of network layer headers ARP, IPv6/ND, IP/IPv6 MDB keys...