CVE-2026-74726

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primaryispromisc under RTNL in bondalbmonitor bondalbmonitor reads primaryispromisc under RCU, then drops RCU and takes RTNL via rtnltrylock before undoing the promiscuity it set on the active slave. In tha...

CVE-2026-74728

In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL baddr in xfsbuffree When xfsbufallocbackingmem fails, xfsbuffree is called with bp-baddr still NULL. The code falls through to the folioput path which calls virttofolioNULL, dereferencing an invalid address and...

CVE-2026-74706

In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocation of auxrdev fails during auxiliary device setup, the error path calls auxiliarydeviceuninit, which eventually invokes bngeauxdevrelease. The release callback...

AZL-97242 CVE-2026-74684 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

CVE-2026-74684

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

CVE-2026-74666

In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packetsetring updates the RX ring state under skreceivequeue.lock, but used to publish the tpacket receive mode through po-prothook.func after releasing that lock...

AZL-97346 CVE-2026-74654 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

CVE-2026-74654

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

CVE-2026-74633

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL eventmod-match when foo has not been loaded. If a later write tries to remove a specific matc...

AZL-97047 CVE-2026-74610 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...

CVE-2026-74610

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...

CVE-2026-74726

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primaryispromisc under RTNL in bondalbmonitor bondalbmonitor reads primaryispromisc under RCU, then drops RCU and takes RTNL via rtnltrylock before undoing the promiscuity it set on the active slave. In tha...

UBUNTU-CVE-2026-74702

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhostscsisetupvqcmds runs from VHOSTSCSISETENDPOINT and allocates each command's protection scatterlist array protsgl according to the acknowledged VIRTIOSCSIFT10PI bit. The comma...

CVE-2026-74610

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...

UBUNTU-CVE-2026-74666

In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packetsetring updates the RX ring state under skreceivequeue.lock, but used to publish the tpacket receive mode through po-prothook.func after releasing that lock...

CVE-2026-74684

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

UBUNTU-CVE-2026-74726

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primaryispromisc under RTNL in bondalbmonitor bondalbmonitor reads primaryispromisc under RCU, then drops RCU and takes RTNL via rtnltrylock before undoing the promiscuity it set on the active slave. In tha...

UBUNTU-CVE-2026-74684

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

CVE-2026-74717

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fwtracer, return NULL on create error Tracer creation can fail by returning either NULL or ERRPTR. The return value is stored without a check on the device, and users treat ERRPTR and NULL the same way. This also causes...

UBUNTU-CVE-2026-74610

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...