CVE-2026-74430 rxrpc: Fix ACKALL packet handling

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...

CVE-2026-74429 rxrpc: Fix the reception of a reply packet before data transmission

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the reception of a reply packet before data transmission Fix rxrpcreceivingreply to handle the reception of an apparent reply DATA packet before rxrpc has had a chance to send any request DATA packets on a client call ...

CVE-2026-74430

The CVE-2026-74430 issue affects the Linux kernel’s rxrpc ACKALL handling. It allowed a forged ACKALL to reach a new service call before replies were queued, risking a null-pointer dereference when rxrpc_rotate_tx_window() dereferenced a NULL txqueue (call->tx_top was zero). The fix adds two c...

CVE-2026-74426 afs: fix NULL pointer dereference in afs_get_tree()

In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afsgettree afsallocsbi uses kzalloc for memory allocation. And, if ctx-dynroot is not null, as-cell and as-volume are null. In traceafsgettree they are dereferenced. KASAN error message: KASAN...

EUVD-2026-59573

In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afsgettree afsallocsbi uses kzalloc for memory allocation. And, if ctx-dynroot is not null, as-cell and as-volume are null. In traceafsgettree they are dereferenced. KASAN error message: KASAN...

CVE-2026-74426

CVE-2026-74426 (Linux kernel) : A NULL pointer dereference in the AFS filesystem during afs_get_tree() was fixed. The root cause involved afs_alloc_sbi() using kzalloc and, if ctx->dyn_root is non-null, as->cell and as->volume being null, leading to dereferencing these fields in trace_af...

CVE-2026-74426 afs: fix NULL pointer dereference in afs_get_tree()

In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afsgettree afsallocsbi uses kzalloc for memory allocation. And, if ctx-dynroot is not null, as-cell and as-volume are null. In traceafsgettree they are dereferenced. KASAN error message: KASAN...

CVE-2026-74425 afs: handle CB.InitCallBackState3 requests without a server record

In the Linux kernel, the following vulnerability has been resolved: afs: handle CB.InitCallBackState3 requests without a server record The cache manager callback path now attaches the server record to an incoming call through the rxrpc peer's app data. That association is not guaranteed to exist...

CVE-2026-74424 fbcon: fix NULL pointer dereference for a console without vc_data

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vcdata fbconnewmodelist runs when a framebuffer's modelist changes. For each console mapped to it with fbdisplayi.mode set, it reads vcconsi.d and passes the vcnum to...

CVE-2026-74425 afs: handle CB.InitCallBackState3 requests without a server record

In the Linux kernel, the following vulnerability has been resolved: afs: handle CB.InitCallBackState3 requests without a server record The cache manager callback path now attaches the server record to an incoming call through the rxrpc peer's app data. That association is not guaranteed to exist...

CVE-2026-74425

In the Linux kernel, CVE-2026-74425 affects the AFS cache manager: CB.InitCallBackState3 requests could arrive without an attached server record to the rxrpc peer’s app data. The fix makes CB.InitCallBackState3 follow the same pattern as other callbacks by checking for an attached server record b...

CVE-2026-74424 fbcon: fix NULL pointer dereference for a console without vc_data

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vcdata fbconnewmodelist runs when a framebuffer's modelist changes. For each console mapped to it with fbdisplayi.mode set, it reads vcconsi.d and passes the vcnum to...

CVE-2026-74424

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vcdata fbconnewmodelist runs when a framebuffer's modelist changes. For each console mapped to it with fbdisplayi.mode set, it reads vcconsi.d and passes the vcnum to...

CVE-2026-74424

CVE-2026-74424 affects the Linux kernel framebuffer console driver (fbcon). The issue arises when fbcon_new_modelist() iterates consoles with fb_display[i].mode set; it can dereference a NULL vc_data because fbcon_set_disp() may set mode before validating vc_data, and fbcon_deinit() can leave the...

CVE-2026-74418 dma-fence: Fix potential tracepoint null pointer dereferences

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Fix potential tracepoint null pointer dereferences Tracedmafencesignaled, tracedmafencewaitend and tracedmafencedestroy can all currently dereference a null fence-ops pointer after it has been reset on fence signalling...

CVE-2026-74418

CVE-2026-74418 covers a Linux kernel issue in the dma-fence tracepoints where Trace_dma_fence_signaled, trace_dma_fence_wait_end, and trace_dma_fence_destroy could dereference a null fence->ops after signalling. The fix uses safe string getters for most tracepoints and moves signaling logic be...

CVE-2026-74418 dma-fence: Fix potential tracepoint null pointer dereferences

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Fix potential tracepoint null pointer dereferences Tracedmafencesignaled, tracedmafencewaitend and tracedmafencedestroy can all currently dereference a null fence-ops pointer after it has been reset on fence signalling...

EUVD-2026-59565

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Fix potential tracepoint null pointer dereferences Tracedmafencesignaled, tracedmafencewaitend and tracedmafencedestroy can all currently dereference a null fence-ops pointer after it has been reset on fence signalling...

EUVD-2026-59561

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Remove the duplicate attr inode dirty marking action Syzbot reported a null-ptr-deref in 1. If the attributes file is not loaded during system mount, a trigger occurs 1 when setxattr is executed in userspace. Remove the...

CVE-2026-74414 hfsplus: Remove the duplicate attr inode dirty marking action

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Remove the duplicate attr inode dirty marking action Syzbot reported a null-ptr-deref in 1. If the attributes file is not loaded during system mount, a trigger occurs 1 when setxattr is executed in userspace. Remove the...