CVE-2026-74528

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...

CVE-2026-74526 scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix potential deadlock in mpi3mrfaultueventemit mpi3mrfaultueventemit runs from the fault watchdog and reset paths where host I/O may already be blocked. GFPKERNEL allocations here, both the local kzallocobj and the...

EUVD-2026-59718

In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fails, initdmadescrings only frees the partially allocated RX rings and returns. The TX rings that were allocated earlier in the same function...

CVE-2026-74525 net: sxgbe: free TX rings on RX allocation failure

In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fails, initdmadescrings only frees the partially allocated RX rings and returns. The TX rings that were allocated earlier in the same function...

CVE-2026-74525 net: sxgbe: free TX rings on RX allocation failure

In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fails, initdmadescrings only frees the partially allocated RX rings and returns. The TX rings that were allocated earlier in the same function...

CVE-2026-74525

In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fails, initdmadescrings only frees the partially allocated RX rings and returns. The TX rings that were allocated earlier in the same function...

CVE-2026-74525

In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fails, initdmadescrings only frees the partially allocated RX rings and returns. The TX rings that were allocated earlier in the same function...

EUVD-2026-59719

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix potential deadlock in mpi3mrfaultueventemit mpi3mrfaultueventemit runs from the fault watchdog and reset paths where host I/O may already be blocked. GFPKERNEL allocations here, both the local kzallocobj and the...

CVE-2026-74525

CVE-2026-74525 affects the Linux kernel net sxgbe driver. When RX descriptor ring allocation fails, init_dma_desc_rings() frees partial RX rings but leaks TX rings allocated earlier. The fix rearranges error labels to clean up TX rings on RX failure. Affected component: net/sxgbe RX/TX ring initi...

CVE-2026-74524

In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove removepudmapping and removep4dmapping obtain a child table base with pudoffsetp4dp, 0 and p4doffsetpgd, 0, then add the index for addr. RISC-V folds page-table...

EUVD-2026-59717

In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove removepudmapping and removep4dmapping obtain a child table base with pudoffsetp4dp, 0 and p4doffsetpgd, 0, then add the index for addr. RISC-V folds page-table...

CVE-2026-74524

In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove removepudmapping and removep4dmapping obtain a child table base with pudoffsetp4dp, 0 and p4doffsetpgd, 0, then add the index for addr. RISC-V folds page-table...

CVE-2026-74524 riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove

In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove removepudmapping and removep4dmapping obtain a child table base with pudoffsetp4dp, 0 and p4doffsetpgd, 0, then add the index for addr. RISC-V folds page-table...

CVE-2026-74524

CVE-2026-74524 : In the Linux kernel (RISC‑V), a fix prevents an out‑of‑bounds page‑table walk during memory hot‑remove. When page‑table levels are folded (Sv48 Sv39), remove_pud_mapping/remove_p4d_mapping compute child bases with pud_offset(p4dp,0) / p4d_offset(pgd,0) and then add an index that ...

CVE-2026-74524 riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove

In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove removepudmapping and removep4dmapping obtain a child table base with pudoffsetp4dp, 0 and p4doffsetpgd, 0, then add the index for addr. RISC-V folds page-table...

CVE-2026-74521

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

CVE-2026-74522

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode. ksmbdclosefd currently marks the file closed a...

CVE-2026-74522 ksmbd: fix use-after-free in __close_file_table_ids()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode. ksmbdclosefd currently marks the file closed a...

CVE-2026-74519

In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: don't free uninitialized devname on error path dtrememberorfreemap duplicates devname for each map entry. If kstrdupconst fails, dtfreemap frees devname in all nummaps entries, including entries that have not...

CVE-2026-74519 pinctrl: devicetree: don't free uninitialized dev_name on error path

In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: don't free uninitialized devname on error path dtrememberorfreemap duplicates devname for each map entry. If kstrdupconst fails, dtfreemap frees devname in all nummaps entries, including entries that have not...