CVE-2026-74577

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtmtos in mplsgetroute mplsgetroute builds the RTMNEWROUTE reply to an RTMGETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed allocskbNLMSGGOODSIZE, .... It sets...

DEBIAN-CVE-2026-74552

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Only report alarms if driver is ready Userspace can read sysfs attributes before driver registration is complete, immediately after devmhwmondeviceregisterwithinfo has been called. At that time, data-hwmondev is not y...

CVE-2026-74563

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: hold the RCU lock across ipv6chkaddr in rdstcpladdrcheck rdstcpladdrcheck looks up a scoped IPv6 interface with devgetbyindexrcu, drops the RCU read-side lock, and only then passes the bare struct netdevice into...

UBUNTU-CVE-2026-74577

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtmtos in mplsgetroute mplsgetroute builds the RTMNEWROUTE reply to an RTMGETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed allocskbNLMSGGOODSIZE, .... It sets...

CVE-2026-74564

In the Linux kernel, the following vulnerability has been resolved: netfilter: xthashlimit: validate hashtable supports XTHASHLIMITRATEMATCH The XTHASHLIMITRATEMATCH flag mode changes the semantics of the dsthashent structure which represents an entry in the hashtable. There is a union area which...

UBUNTU-CVE-2026-74576

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobjext array from its own slab" avoided recursive allocation of objexts from kmalloc caches of the same...

CVE-2026-74576

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobjext array from its own slab" avoided recursive allocation of objexts from kmalloc caches of the same...

CVE-2026-74554

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bounds clearbit in ath12kmacdppeercleanup ath12kmacdppeercleanup clears the ML peer ID slot on the freemlpeeridmap bitmap by indexing it with dppeer-peerid. That is wrong: dppeer-peerid for an MLO peer...

CVE-2026-74554

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bounds clearbit in ath12kmacdppeercleanup ath12kmacdppeercleanup clears the ML peer ID slot on the freemlpeeridmap bitmap by indexing it with dppeer-peerid. That is wrong: dppeer-peerid for an MLO peer...

UBUNTU-CVE-2026-74570

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfsrlrealloc and ntfsrlreallocnofail...

UBUNTU-CVE-2026-74566

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring key-chunk byte order agree with keyringdiffobjects keyringgetkeychunk loads description bytes into the index chunk low address first, while keyringdiffobjects numbers the first differing bit from the low end an...

CVE-2026-74551

In the Linux kernel, the following vulnerability has been resolved: hwmon: nzxt-smart2 DMA-align output buffer Sashiko reports: When sendoutputreport calls hidhwoutputreport, the underlying USB HID core calls usbinterruptmsg which maps this buffer directly for DMA. When the DMA mapping flushes or...

UBUNTU-CVE-2026-74564

In the Linux kernel, the following vulnerability has been resolved: netfilter: xthashlimit: validate hashtable supports XTHASHLIMITRATEMATCH The XTHASHLIMITRATEMATCH flag mode changes the semantics of the dsthashent structure which represents an entry in the hashtable. There is a union area which...

UBUNTU-CVE-2026-74550

In the Linux kernel, the following vulnerability has been resolved: net: do not send ICMP/NDISC Redirects when peer allocation fails When inetgetpeerv4 or inetgetpeerv6 fails to allocate a peer entry under memory pressure or tree size caps, redirect handlers previously fell back to sending...

CVE-2026-74550

In the Linux kernel, the following vulnerability has been resolved: net: do not send ICMP/NDISC Redirects when peer allocation fails When inetgetpeerv4 or inetgetpeerv6 fails to allocate a peer entry under memory pressure or tree size caps, redirect handlers previously fell back to sending...

UBUNTU-CVE-2026-74557

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer iscsiscsicmdrsp copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes,...

CVE-2026-74551

In the Linux kernel, the following vulnerability has been resolved: hwmon: nzxt-smart2 DMA-align output buffer Sashiko reports: When sendoutputreport calls hidhwoutputreport, the underlying USB HID core calls usbinterruptmsg which maps this buffer directly for DMA. When the DMA mapping flushes or...

CVE-2026-74541

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: clear isodata always when detaching conn from hcon When setting conn-hcon = NULL, also conn-hcon-isodata = NULL is necessary, otherwise later isoconnfree will UAF. Fix clearing of isodata in isosockdisconn Fixes...

CVE-2026-74545

In the Linux kernel, the following vulnerability has been resolved: rtase: fix double free of multi-frag skb on DMA map failure In rtasestartxmit, when the head buffer DMA mapping fails after rtasexmitfrags has mapped all fragments, the error path clears the fragment descriptors with...

CVE-2026-74542

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folioqueue ENOMEM in writeback by adding a mempool Fix the handling of folioqueue allocation failure in writeback by adding a mempool and passing in gfpt flags to the rolling buffer functions that allocate memory, usin...