CVE-2026-74429 rxrpc: Fix the reception of a reply packet before data transmission

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the reception of a reply packet before data transmission Fix rxrpcreceivingreply to handle the reception of an apparent reply DATA packet before rxrpc has had a chance to send any request DATA packets on a client call ...

CVE-2026-74430

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...

CVE-2026-74430 rxrpc: Fix ACKALL packet handling

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...

CVE-2026-74430

The CVE-2026-74430 issue affects the Linux kernel’s rxrpc ACKALL handling. It allowed a forged ACKALL to reach a new service call before replies were queued, risking a null-pointer dereference when rxrpc_rotate_tx_window() dereferenced a NULL txqueue (call->tx_top was zero). The fix adds two c...

CVE-2026-74429 rxrpc: Fix the reception of a reply packet before data transmission

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the reception of a reply packet before data transmission Fix rxrpcreceivingreply to handle the reception of an apparent reply DATA packet before rxrpc has had a chance to send any request DATA packets on a client call ...

EUVD-2026-59577

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...

CVE-2026-74430 rxrpc: Fix ACKALL packet handling

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...

CVE-2026-74429

CVE-2026-74429 describes a Linux kernel issue in rxrpc where a reply DATA packet can be received before the client has sent any request DATA packets, potentially causing an oops in rxrpc_rotate_tx_window. The fix updates rxrpc_receiving_reply() to detect an apparent reply before exposure of the c...

CVE-2026-74426

In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afsgettree afsallocsbi uses kzalloc for memory allocation. And, if ctx-dynroot is not null, as-cell and as-volume are null. In traceafsgettree they are dereferenced. KASAN error message: KASAN...

CVE-2026-74426

CVE-2026-74426 (Linux kernel) : A NULL pointer dereference in the AFS filesystem during afs_get_tree() was fixed. The root cause involved afs_alloc_sbi() using kzalloc and, if ctx->dyn_root is non-null, as->cell and as->volume being null, leading to dereferencing these fields in trace_af...

CVE-2026-74426 afs: fix NULL pointer dereference in afs_get_tree()

In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afsgettree afsallocsbi uses kzalloc for memory allocation. And, if ctx-dynroot is not null, as-cell and as-volume are null. In traceafsgettree they are dereferenced. KASAN error message: KASAN...

EUVD-2026-59573

In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afsgettree afsallocsbi uses kzalloc for memory allocation. And, if ctx-dynroot is not null, as-cell and as-volume are null. In traceafsgettree they are dereferenced. KASAN error message: KASAN...

CVE-2026-74426 afs: fix NULL pointer dereference in afs_get_tree()

In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afsgettree afsallocsbi uses kzalloc for memory allocation. And, if ctx-dynroot is not null, as-cell and as-volume are null. In traceafsgettree they are dereferenced. KASAN error message: KASAN...

CVE-2026-74425 afs: handle CB.InitCallBackState3 requests without a server record

In the Linux kernel, the following vulnerability has been resolved: afs: handle CB.InitCallBackState3 requests without a server record The cache manager callback path now attaches the server record to an incoming call through the rxrpc peer's app data. That association is not guaranteed to exist...

CVE-2026-74424 fbcon: fix NULL pointer dereference for a console without vc_data

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vcdata fbconnewmodelist runs when a framebuffer's modelist changes. For each console mapped to it with fbdisplayi.mode set, it reads vcconsi.d and passes the vcnum to...

CVE-2026-74424 fbcon: fix NULL pointer dereference for a console without vc_data

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vcdata fbconnewmodelist runs when a framebuffer's modelist changes. For each console mapped to it with fbdisplayi.mode set, it reads vcconsi.d and passes the vcnum to...

CVE-2026-74424

CVE-2026-74424 affects the Linux kernel framebuffer console driver (fbcon). The issue arises when fbcon_new_modelist() iterates consoles with fb_display[i].mode set; it can dereference a NULL vc_data because fbcon_set_disp() may set mode before validating vc_data, and fbcon_deinit() can leave the...

CVE-2026-74424

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vcdata fbconnewmodelist runs when a framebuffer's modelist changes. For each console mapped to it with fbdisplayi.mode set, it reads vcconsi.d and passes the vcnum to...

CVE-2026-74425

In the Linux kernel, CVE-2026-74425 affects the AFS cache manager: CB.InitCallBackState3 requests could arrive without an attached server record to the rxrpc peer’s app data. The fix makes CB.InitCallBackState3 follow the same pattern as other callbacks by checking for an attached server record b...

CVE-2026-74425 afs: handle CB.InitCallBackState3 requests without a server record

In the Linux kernel, the following vulnerability has been resolved: afs: handle CB.InitCallBackState3 requests without a server record The cache manager callback path now attaches the server record to an incoming call through the rxrpc peer's app data. That association is not guaranteed to exist...