CVE-2026-74753 perf: Reject exited events as group leaders

In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as group leaders perfeventremoveonexec sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can remain open, however, and perfeventopen...

CVE-2026-74748 netfilter: ipset: fix refcount race between list:set GC and swap

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap ipsetputbyindex resolved the index to a set pointer under RCU, then took ipsetreflock in ipsetput to decrement set-ref. ipsetswap holds that same lock while swappin...

CVE-2026-74748

CVE-2026-74748 is a refcount race in the Linux kernel's netfilter ipset subsystem. The function __ip_set_put_byindex() resolves a set index under RCU but decrements the reference count only after acquiring ip_set_ref_lock. A concurrent ip_set_swap() call can interleave between these two steps, ca...

CVE-2026-74748

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap ipsetputbyindex resolved the index to a set pointer under RCU, then took ipsetreflock in ipsetput to decrement set-ref. ipsetswap holds that same lock while swappin...

CVE-2026-74748 netfilter: ipset: fix refcount race between list:set GC and swap

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap ipsetputbyindex resolved the index to a set pointer under RCU, then took ipsetreflock in ipsetput to decrement set-ref. ipsetswap holds that same lock while swappin...

CVE-2026-74740 net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: fix TOCTOU NULL deref on a-gotochain tcfactionexec handles TCACTGOTOCHAIN by first checking rcuaccesspointera-gotochain and then calling tcfactiongotochainexec, which does a second, independent...

CVE-2026-74741

CVE-2026-74741 is a NULL pointer dereference in the Linux kernel's ngbe network driver, occurring in the non-MSI-X interrupt enabling path. When the driver operates in legacy INTx or single MSI mode, the wx->msix_entry pointer is not allocated or initialized, so calling NGBE_INTR_MISC(wx) dere...

CVE-2026-74740

CVE-2026-74740 is a TOCTOU (time-of-check-time-of-use) NULL pointer dereference in the Linux kernel's net/sched: act_api subsystem. When handling TC_ACT_GOTO_CHAIN, tcf_action_exec() performs an initial rcu_access_pointer(a->goto_chain) check, then calls tcf_action_goto_chain_exec() which perf...

CVE-2026-74740 net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: fix TOCTOU NULL deref on a-gotochain tcfactionexec handles TCACTGOTOCHAIN by first checking rcuaccesspointera-gotochain and then calling tcfactiongotochainexec, which does a second, independent...

CVE-2026-74741 net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling

In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling In non-MSI-X mode such as legacy INTx or single MSI, wx-msixentry is not allocated or initialized. Calling NGBEINTRMISCwx dereferences wx-msixentry-entry,...

CVE-2026-74741

In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling In non-MSI-X mode such as legacy INTx or single MSI, wx-msixentry is not allocated or initialized. Calling NGBEINTRMISCwx dereferences wx-msixentry-entry,...

EUVD-2026-66570

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: fix TOCTOU NULL deref on a-gotochain tcfactionexec handles TCACTGOTOCHAIN by first checking rcuaccesspointera-gotochain and then calling tcfactiongotochainexec, which does a second, independent...

CVE-2026-74740

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: fix TOCTOU NULL deref on a-gotochain tcfactionexec handles TCACTGOTOCHAIN by first checking rcuaccesspointera-gotochain and then calling tcfactiongotochainexec, which does a second, independent...

CVE-2026-74741 net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling

In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling In non-MSI-X mode such as legacy INTx or single MSI, wx-msixentry is not allocated or initialized. Calling NGBEINTRMISCwx dereferences wx-msixentry-entry,...

CVE-2026-74738 regmap: sdw-mbq: don't call an unset readable_reg callback

In the Linux kernel, the following vulnerability has been resolved: regmap: sdw-mbq: don't call an unset readablereg callback regmapsdwmbqpollbusy decides whether to poll the Function Busy bit by calling ctx-readablereg, which is a straight copy of config-readablereg. That callback is optional:...

CVE-2026-74738 regmap: sdw-mbq: don't call an unset readable_reg callback

In the Linux kernel, the following vulnerability has been resolved: regmap: sdw-mbq: don't call an unset readablereg callback regmapsdwmbqpollbusy decides whether to poll the Function Busy bit by calling ctx-readablereg, which is a straight copy of config-readablereg. That callback is optional:...

CVE-2026-74738

In the Linux kernel, the following vulnerability has been resolved: regmap: sdw-mbq: don't call an unset readablereg callback regmapsdwmbqpollbusy decides whether to poll the Function Busy bit by calling ctx-readablereg, which is a straight copy of config-readablereg. That callback is optional:...

CVE-2026-74738

CVE-2026-74738 affects the Linux kernel regmap sdw-mbq (SoundWire Modem Bus Queued) subsystem. The function regmap_sdw_mbq_poll_busy() dereferences ctx->readable_reg() without checking for NULL , but this callback is optional—drivers such as es9356 and tac5xx2-sdw build an MBQ regmap without s...

EUVD-2026-66568

In the Linux kernel, the following vulnerability has been resolved: regmap: sdw-mbq: don't call an unset readablereg callback regmapsdwmbqpollbusy decides whether to poll the Function Busy bit by calling ctx-readablereg, which is a straight copy of config-readablereg. That callback is optional:...

CVE-2026-74734 firewire: ohci: fix NULL pointer dereference in ar_context_release

In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: fix NULL pointer dereference in arcontextrelease During the error handling path of the driver's probe function, a NULL pointer dereference can occur in arcontextrelease. When pciprobe fails early e.g., if...