CVE-2026-74434

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpcrecvmsgoob takes a received oob message off recvmsgoobq and, if a response is needed, moves it onto the pendingoobq tree. However, only the unlink from recvmsgoob...

EUVD-2026-59581

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpcrecvmsgoob takes a received oob message off recvmsgoobq and, if a response is needed, moves it onto the pendingoobq tree. However, only the unlink from recvmsgoob...

EUVD-2026-59579

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix leak of released call in recvmsgMSGPEEK Fix rxrpcrecvmsg to also drop the ref it holds on an already-released call if MSGPEEK is in force the function holds a ref on the call irrespective of whether MSGPEEK is specifie...

CVE-2026-74432 rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix leak of released call in recvmsgMSGPEEK Fix rxrpcrecvmsg to also drop the ref it holds on an already-released call if MSGPEEK is in force the function holds a ref on the call irrespective of whether MSGPEEK is specifie...

CVE-2026-74432

The CVE-2026-74432 issue affects the Linux kernel’s rxrpc recvmsg path. The fix adds dropping of a reference on an already-released call when MSG_PEEK is in force, addressing a leak where a ref was held regardless of MSG_PEEK usage. Affected component: rxrpc_recvmsg() in the kernel; root cause: l...

CVE-2026-74431

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential infinite loop in rxrpcrecvmsg Fix the wait in rxrpcrecvmsg also take check the oob queue...

CVE-2026-74429

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the reception of a reply packet before data transmission Fix rxrpcreceivingreply to handle the reception of an apparent reply DATA packet before rxrpc has had a chance to send any request DATA packets on a client call ...

CVE-2026-74430

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...

CVE-2026-74428

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix double unlock in rxrpcrecvmsg Fix a double unlock in rxrpcrecvmsg when dealing with OOB messages...

CVE-2026-74427

The CVE-2026-74427 entry describes a Linux kernel fix for AFS (Automount File System) related to netns teardown. The vulnerability fix ensures the teardown of an AFS network namespace cancels the preallocation charger work item that maintains a charged rxrpc call/conn/peer queue before incoming c...

CVE-2026-74427

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls a...

CVE-2026-74424

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vcdata fbconnewmodelist runs when a framebuffer's modelist changes. For each console mapped to it with fbdisplayi.mode set, it reads vcconsi.d and passes the vcnum to...

CVE-2026-74425

In the Linux kernel, the following vulnerability has been resolved: afs: handle CB.InitCallBackState3 requests without a server record The cache manager callback path now attaches the server record to an incoming call through the rxrpc peer's app data. That association is not guaranteed to exist...

EUVD-2026-59570

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix leak when pinning ubuf pages When pinuserpagesfast returns fewer pages than requested, the pages that were successfully pinned are not released, leading to a leak. Fix this by unpinning any partially pinned pag...

CVE-2026-74423

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix leak when pinning ubuf pages When pinuserpagesfast returns fewer pages than requested, the pages that were successfully pinned are not released, leading to a leak. Fix this by unpinning any partially pinned pag...

CVE-2026-74423 accel/amdxdna: Fix leak when pinning ubuf pages

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix leak when pinning ubuf pages When pinuserpagesfast returns fewer pages than requested, the pages that were successfully pinned are not released, leading to a leak. Fix this by unpinning any partially pinned pag...

CVE-2026-74423

The CVE-2026-74423 issue is in the Linux kernel, specifically accel/amdxdna: there is a leak when pin_user_pages_fast() pins fewer pages than requested. The pages that were successfully pinned are not released on failure. The documented fix unpins any partially pinned pages before returning failu...

CVE-2026-74421

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dwdp: Switch to drmmkzalloc Driver makes use of drmmencoderinit to initialize the encoder and automatically handle the cleanup by registering drmencodercleanup with drmmaddaction. However, the internal structure...

CVE-2026-74422

In CVE-2026-74422, the Linux kernel’s drm/rockchip inno-hdmi encoder uses a device-managed allocation (devm_kzalloc) for its internal structure during component_bind_all. When the DRM device reference is dropped (drm_dev_put) and drmm_encoder_alloc_release runs, the encoder structure may have bee...

CVE-2026-74422

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: inno-hdmi: Switch to drmmkzalloc Driver makes use of drmmencoderinit to initialize the encoder and automatically handle the cleanup by registering drmencodercleanup with drmmaddaction. However, the internal structur...