6699 matches found
EUVD-2026-59534
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...
CVE-2026-74366 wifi: ath12k: fix NULL deref in change_sta_links for unready link
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in changestalinks for unready link ieee80211setactivelinks calls ieee80211linkusechannel for each newly-added link and WARNONONCEs if it fails. The call uses assignonfailure=true, which allows mac8021...
CVE-2026-74366
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in changestalinks for unready link ieee80211setactivelinks calls ieee80211linkusechannel for each newly-added link and WARNONONCEs if it fails. The call uses assignonfailure=true, which allows mac8021...
CVE-2026-74327 vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()
In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix NULL pointer dereference in isvmareahugepages findvmarea can return NULL if the given address is not a valid vmalloc area. Check the return value before dereferencing it to avoid a kernel crash...
CVE-2026-72485
CVE-2026-72485 describes a Linux kernel vulnerability in the coresight platform where nr_outconns/nr_inconns were incremented before allocations, causing a premature counter bump and potential panics during cleanup when allocations failed. The issue affects the coresight_add_out_conn() and coresi...
CVE-2026-72485 coresight: platform: defer connection counter increment until alloc succeeds
In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...
CVE-2026-72460 apparmor: check label build before no_new_privs test
In the Linux kernel, the following vulnerability has been resolved: apparmor: check label build before nonewprivs test aachangeprofile builds a replacement label with fnlabelbuildinscope before the nonewprivs subset check. The build helper can fail and return NULL or an ERRPTR, but the result was...
CVE-2026-72432 tpm_crb: Check ACPI_COMPANION() against NULL during probe
In the Linux kernel, the following vulnerability has been resolved: tpmcrb: Check ACPICOMPANION against NULL during probe Every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, so platform drivers that rely on the...
EUVD-2026-59331
In the Linux kernel, the following vulnerability has been resolved: tpmcrb: Check ACPICOMPANION against NULL during probe Every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, so platform drivers that rely on the...
CVE-2026-72424 rtc: msc313: fix NULL deref in shared IRQ handler at probe
In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313rtcprobe calls devmrequestirq with IRQFSHARED and &pdev-dev as the cookie, but platformsetdrvdata is only called later after the clock setup. With a shared IRQ line...
CVE-2026-72424 rtc: msc313: fix NULL deref in shared IRQ handler at probe
In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313rtcprobe calls devmrequestirq with IRQFSHARED and &pdev-dev as the cookie, but platformsetdrvdata is only called later after the clock setup. With a shared IRQ line...
CVE-2026-72327
The CVE-2026-72327 issue affects the Linux kernel DRM v3d indirect CSD setup. v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object from a userspace-supplied handle and may return NULL; this NULL is stored in info->indirect and later dereferenced by the indirect CSD job, turnin...
CVE-2026-72242 selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sksocket dereference in selinuxsctpbindconnect selinuxsctpbindconnect dereferences sk-sksocket to pass a struct socket to selinuxsocketbind and selinuxsocketconnecthelper. However, when the hook is invoked from the...
CVE-2026-72036 net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
In the Linux kernel, the following vulnerability has been resolved: net/sched: schmultiq: Replace direct dequeue call with peek and qdiscdequeuepeeked multiqdequeue takes a packet from a band's child with a direct -dequeue call after multiqpeek peeked it. When the child is non-work-conserving the...
CVE-2026-72036
Summary (CVE-2026-72036): In the Linux kernel net/sched sch_multiq code, a direct dequeue() after multiq_peek() could return a different skb or mis-handle a stash in non-work-conserving paths, potentially desyncing qlen/backlog and, in some cases (e.g., certain qfq children), dereferencing NULL a...
CVE-2026-72035
CVE-2026-72035 involves the Linux kernel net/sched, specifically sch_taprio. A direct dequeue call was replaced with a peek-based path via qdisc_dequeue_peeked to correct a bug where tapping a non-work-conserving child qdisc could cause an orphaned or desynced skb and, in some cases, dereference ...
CVE-2026-72034
CVE-2026-72034 — Linux kernel fhandle detaching mounts issue : A fix updated the fhandle path to reject detached mounts by returning false when the RCU read observes a detached mount, preventing a detached mount from authorizing open_by_handle_at() access. The issue stemmed from the mount namespa...
CVE-2026-72034 fhandle: reject detached mounts in capable_wrt_mount()
In the Linux kernel, the following vulnerability has been resolved: fhandle: reject detached mounts in capablewrtmount The recent fhandle RCU fix moved the mount namespace capability check into capablewrtmount, so a non-NULL mntnamespace survives the nscapable dereference. The helper still assume...
CVE-2026-72034 fhandle: reject detached mounts in capable_wrt_mount()
In the Linux kernel, the following vulnerability has been resolved: fhandle: reject detached mounts in capablewrtmount The recent fhandle RCU fix moved the mount namespace capability check into capablewrtmount, so a non-NULL mntnamespace survives the nscapable dereference. The helper still assume...
