CVE-2026-74576 mm/slab: prevent unbounded recursion in free path with new kmalloc type

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobjext array from its own slab" avoided recursive allocation of objexts from kmalloc caches of the same...

CVE-2026-74570 ntfs: harden runlist realloc size calculations

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfsrlrealloc and ntfsrlreallocnofail...

CVE-2026-74570

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfsrlrealloc and ntfsrlreallocnofail...

CVE-2026-74570 ntfs: harden runlist realloc size calculations

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfsrlrealloc and ntfsrlreallocnofail...

CVE-2026-74570

CVE-2026-74570 is a Linux kernel vulnerability affecting NTFS runlist handling. The issue stems from unsafe/overflow-prone size calculations in runlist element counts used by ntfs_rl_realloc() and ntfs_rl_realloc_nofail(). A fix was implemented by adding a shared helper to safely convert runlist ...

EUVD-2026-59635

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfsrlrealloc and ntfsrlreallocnofail...

CVE-2026-74570

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfsrlrealloc and ntfsrlreallocnofail...

CVE-2026-74569

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: widen NAT rewrite delta to s32 in siphelptcp siphelptcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than...

CVE-2026-74569 netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: widen NAT rewrite delta to s32 in siphelptcp siphelptcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than...

CVE-2026-74569

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: widen NAT rewrite delta to s32 in siphelptcp siphelptcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than...

CVE-2026-74569

CVE-2026-74569 affects the Linux kernel netfilter nf_conntrack_sip path. The issue stems from NAT rewrite delta handling in sip_help_tcp(), where diff/tdiff was stored in 16-bit fields and could overflow within large SIP messages, causing a read past the skb tail. The fix widens diff, tdiff, and ...

CVE-2026-74569 netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: widen NAT rewrite delta to s32 in siphelptcp siphelptcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than...

EUVD-2026-59634

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: widen NAT rewrite delta to s32 in siphelptcp siphelptcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than...

CVE-2026-74559 xsk: drain continuation descs after overflow in xsk_build_skb()

In the Linux kernel, the following vulnerability has been resolved: xsk: drain continuation descs after overflow in xskbuildskb Fix generic xmit path multi-buffer logic when packets are either too big count of descriptors exceed MAXSKBFRAGS or an invalid descriptor is included in fragmented packe...

CVE-2026-74559 xsk: drain continuation descs after overflow in xsk_build_skb()

In the Linux kernel, the following vulnerability has been resolved: xsk: drain continuation descs after overflow in xskbuildskb Fix generic xmit path multi-buffer logic when packets are either too big count of descriptors exceed MAXSKBFRAGS or an invalid descriptor is included in fragmented packe...

CVE-2026-74559

In the Linux kernel, the following vulnerability has been resolved: xsk: drain continuation descs after overflow in xskbuildskb Fix generic xmit path multi-buffer logic when packets are either too big count of descriptors exceed MAXSKBFRAGS or an invalid descriptor is included in fragmented packe...

CVE-2026-74559

CVE-2026-74559 affects the Linux kernel XDP/AF_XDP path. The issue arises in the xsk_build_skb() flow where, on overflow of descriptors (or invalid descriptors in fragmented packets), the generic transmit path multi-buffer handling could mishandle descriptors. The fix introduces xdp_sock::drain_c...

EUVD-2026-59624

In the Linux kernel, the following vulnerability has been resolved: xsk: drain continuation descs after overflow in xskbuildskb Fix generic xmit path multi-buffer logic when packets are either too big count of descriptors exceed MAXSKBFRAGS or an invalid descriptor is included in fragmented packe...

CVE-2026-74556

CVE-2026-74556 – Linux kernel (scsi: libiscsi_tcp) Technical summary from provided documents: The vulnerability arises in the iSCSI path handling within the Linux kernel where iscsi_tcp_hdr_dissect() places the data segment of several PDUs into the fixed-size conn->data buffer (8192 bytes). Fo...

CVE-2026-74556

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Bound SCSI Response data segment to the connection buffer iscsitcphdrdissect receives the data segment of several PDU types into the fixed-size conn-data buffer, which is allocated for ISCSIDEFMAXRECVSEGLEN 819...