CVE-2026-74706 bnge: Fix NULL pointer dereference in aux device release

In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocation of auxrdev fails during auxiliary device setup, the error path calls auxiliarydeviceuninit, which eventually invokes bngeauxdevrelease. The release callback...

CVE-2026-74684

This vulnerability is a NULL pointer dereference in the Linux kernel's net: tap module, specifically in tap_get_user_xdp(). When the vhost TX path passes an XDP buffer containing a GSO virtio-net header with the protocol field set to zero, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol...

EUVD-2026-64371

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

CVE-2026-74684 net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

CVE-2026-74684 net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

CVE-2026-74684 net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

CVE-2026-74654 serial: 8250_dma: Clear stale RX state on shutdown

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

EUVD-2026-64591

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

CVE-2026-74654 serial: 8250_dma: Clear stale RX state on shutdown

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

CVE-2026-74654

This Linux kernel vulnerability affects the serial 8250 DMA driver . When a serial port is closed while an RX DMA transfer is active, serial8250_release_dma() leaves the rx_running flag set. On subsequent reopen, the DesignWare BUSY workaround calls serial8250_rx_dma_flush() before a new RX chann...

CVE-2026-74633

CVE-2026-74633 is a NULL pointer dereference in the Linux kernel's ftrace tracing subsystem. When a module-only event filter (e.g., :mod:foo) is cached while the module is not yet loaded, event_mod->match remains NULL. A subsequent write attempting to remove a specific match from that module p...

CVE-2026-74633 tracing: Fix NULL pointer dereference in module event cache removal

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL eventmod-match when foo has not been loaded. If a later write tries to remove a specific matc...

CVE-2026-74633 tracing: Fix NULL pointer dereference in module event cache removal

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL eventmod-match when foo has not been loaded. If a later write tries to remove a specific matc...

EUVD-2026-64570

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL eventmod-match when foo has not been loaded. If a later write tries to remove a specific matc...

EUVD-2026-64547

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...

CVE-2026-74610 tls: don't leave a full plaintext sk_msg ring unpushed

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...

CVE-2026-74610

CVE-2026-74610 is a kernel NULL pointer dereference in the Linux kernel's TLS ULP (Upper Layer Protocol) implementation. The root cause is in tls_sw_sendmsg_locked(): when the copy path fills the plaintext sk_msg ring, the full_record flag is not set, leaving the record unpushed. A subsequent spl...

CVE-2026-74610 tls: don't leave a full plaintext sk_msg ring unpushed

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...

CLSA-2026-1787398056 libtiff: Fix of 2 CVEs

CVE-2024-13978: NULL pointer dereference in tiff2pdf t2preadtiffinit on a tiled TIFF declaring a zero tile width or length - CVE-2025-9165: memory leak in tiffcmp when the second input file cannot be opened...

CLSA-2026-1787396206 Fix CVE(s): CVE-2024-6239

SECURITY UPDATE: crash in pdfinfo -dests on broken documents: printDestinations wrapped the destination name returned by Catalog::getDestNameTreeName / Catalog::getDestsName into a new GooString before testing it, so a document whose name tree is short or whose /Dests entry is not a dictionary ma...