CVE-2026-74684

This vulnerability is a NULL pointer dereference in the Linux kernel's net: tap module, specifically in tap_get_user_xdp(). When the vhost TX path passes an XDP buffer containing a GSO virtio-net header with the protocol field set to zero, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol...

CVE-2026-74684 net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

CVE-2026-74654

This Linux kernel vulnerability affects the serial 8250 DMA driver . When a serial port is closed while an RX DMA transfer is active, serial8250_release_dma() leaves the rx_running flag set. On subsequent reopen, the DesignWare BUSY workaround calls serial8250_rx_dma_flush() before a new RX chann...

EUVD-2026-64591

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

CVE-2026-74654 serial: 8250_dma: Clear stale RX state on shutdown

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

CVE-2026-74654 serial: 8250_dma: Clear stale RX state on shutdown

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

CVE-2026-74633 tracing: Fix NULL pointer dereference in module event cache removal

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL eventmod-match when foo has not been loaded. If a later write tries to remove a specific matc...

EUVD-2026-64570

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL eventmod-match when foo has not been loaded. If a later write tries to remove a specific matc...

CVE-2026-74633

CVE-2026-74633 is a NULL pointer dereference in the Linux kernel's ftrace tracing subsystem. When a module-only event filter (e.g., :mod:foo) is cached while the module is not yet loaded, event_mod->match remains NULL. A subsequent write attempting to remove a specific match from that module p...

CVE-2026-74633 tracing: Fix NULL pointer dereference in module event cache removal

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL eventmod-match when foo has not been loaded. If a later write tries to remove a specific matc...

CVE-2026-74610 tls: don't leave a full plaintext sk_msg ring unpushed

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...

CVE-2026-74610

CVE-2026-74610 is a kernel NULL pointer dereference in the Linux kernel's TLS ULP (Upper Layer Protocol) implementation. The root cause is in tls_sw_sendmsg_locked(): when the copy path fills the plaintext sk_msg ring, the full_record flag is not set, leaving the record unpushed. A subsequent spl...

CVE-2026-74610 tls: don't leave a full plaintext sk_msg ring unpushed

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...

EUVD-2026-64547

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...

poppler: Freedesktop Poppler: Denial of Service via null pointer dereference in JBIG2Stream::rewind function

A flaw was found in Freedesktop Poppler. A remote attacker could exploit a null pointer dereference vulnerability in the JBIG2Stream::rewind function. This could lead to a denial of service DoS, making the application unavailable to legitimate users...

SUSE CVE-2026-68282

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogixdp: Add missing error check for platformgetresource Add missing error check for platformgetresource return value to prevent NULL pointer dereference when memory resource is not available...

SUSE CVE-2026-68291

In the Linux kernel, the following vulnerability has been resolved: idpf: fix maxvport related crash on allocation error during init Set adapter-maxvports only after successful allocation of vports, netdevs and vportconfig buffers. This fixes possible crashes on reset or rmmod, following failed...

SUSE CVE-2026-68327

In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxlpciinitone stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxlpciremoveone, including failur...

SUSE CVE-2026-73199

A flaw was found in the ipa-enrollment SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol LDAP extended operation. By omitting the request value for the JOINOID in the ipa-enrollment extende...

Linux Distros Unpatched Vulnerability : CVE-2026-74702

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vhost-scsi: reject feature changes after endpoint vhostscsisetupvqcmds runs from VHOSTSCSISETENDPOINT and allocates each command's protection scatterlist array...