CVE-2026-74414

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Remove the duplicate attr inode dirty marking action Syzbot reported a null-ptr-deref in 1. If the attributes file is not loaded during system mount, a trigger occurs 1 when setxattr is executed in userspace. Remove the...

CVE-2026-74418

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Fix potential tracepoint null pointer dereferences Tracedmafencesignaled, tracedmafencewaitend and tracedmafencedestroy can all currently dereference a null fence-ops pointer after it has been reset on fence signalling...

CVE-2026-74403

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Check for page allocation failure correctly in TIO Sashiko notes: if snpallocfirmwarepages returns NULL under memory pressure, is it safe to pass it directly to pageaddress? On architectures without HASHEDPAGEVIRTUA...

CVE-2026-74400

In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpfset|removedentryxattr for negative dentries bpfsetdentryxattr and bpfremovedentryxattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passe...

CVE-2026-74407

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery SSR. The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed...

CVE-2026-74406

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...

CVE-2026-74387

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...

CVE-2026-74379

In the Linux kernel, the following vulnerability has been resolved: dax/kmem: account for partial discontiguous resource upon removal When devdaxkmemprobe partially succeeds at least one range is mapped but a subsequent range fails requestmemregion or addmemorydrivermanaged, the probe silently...

CVE-2026-74342

In the Linux kernel, the following vulnerability has been resolved: kernfs: link kn to its parent before the LSM init hook After commit 12e9e3cd03b5 "simpexattr: use per-sb cache", kernfsxattrset and kernfsxattrget compute the cache via kernfsrootkn before any other check. kernfsrootkn walks...

CVE-2026-74335

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpftaskfromvpid bpftaskfromvpid looks up a task in the pid namespace of the current task, via findtaskbyvpid: findtaskbyvpidvpid findtaskbypidnsvpid, taskactivepidnscurrent findpidnsnr, ns -...

CVE-2026-74327

In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix NULL pointer dereference in isvmareahugepages findvmarea can return NULL if the given address is not a valid vmalloc area. Check the return value before dereferencing it to avoid a kernel crash...

CVE-2026-74322

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996macwritetxwi80211 For injected frames e.g. via radiotap, mac80211 can pass info-control.vif = NULL, as explicitly noted in struct ieee80211txinfo. Check vif point...

CVE-2026-74321

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid pointer dereference in btrfsrundelayedrefs In the beginning of the loop, we try to obtain a locked delayed ref head, if 'lockedref' is currently NULL, by calling btrfsselectrefhead, which can return an error...

CVE-2026-74311

In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: tear down old virtqueues before restore virtiodevicerestore resets the device and restores the negotiated features before calling -restore. viortcfreeze intentionally leaves the existing virtqueues in place so the...

CVE-2026-74303

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

CVE-2026-74286

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

CVE-2026-74274

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fill first free targets slot during auto-discovery Any invalid endpoint decoder pointer in the target array of an active region is not allowed by cxl driver. This means cxl driver always assumes the first p-nrtargets...

CVE-2026-74259

In the Linux kernel, the following vulnerability has been resolved: cifs: remove all cifs files before kill super Cifs files may be put into fileinfoputwq during umounting cifs. After umount done, cifsFileInfoputfinal is called, which cause following BUG: BUG: kernel NULL pointer dereference,...

CVE-2026-74263

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: check skbclone in control TX t7xxportctrltx clones each skb fragment before passing it to the port transmit path. The clone is used immediately to set cloned-len, so an skbclone failure results in a NULL pointer...

CVE-2026-74266

In the Linux kernel, the following vulnerability has been resolved: net/sched: schdualpi2: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever dualpi2 drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog befo...