CVE-2026-74322 wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996_mac_write_txwi_80211()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996macwritetxwi80211 For injected frames e.g. via radiotap, mac80211 can pass info-control.vif = NULL, as explicitly noted in struct ieee80211txinfo. Check vif point...

CVE-2026-74322

In the Linux kernel, the wifi/mt76 mt7996 path is affected by CVE-2026-74322. The vulnerability stems from a possible NULL pointer dereference in mt7996_mac_write_txwi_80211() when handling injected frames (e.g., radiotap) where info->control.vif can be NULL. The code originally calls ieee8021...

CVE-2026-74321 btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid pointer dereference in btrfsrundelayedrefs In the beginning of the loop, we try to obtain a locked delayed ref head, if 'lockedref' is currently NULL, by calling btrfsselectrefhead, which can return an error...

EUVD-2026-59468

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid pointer dereference in btrfsrundelayedrefs In the beginning of the loop, we try to obtain a locked delayed ref head, if 'lockedref' is currently NULL, by calling btrfsselectrefhead, which can return an error...

CVE-2026-74321 btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid pointer dereference in btrfsrundelayedrefs In the beginning of the loop, we try to obtain a locked delayed ref head, if 'lockedref' is currently NULL, by calling btrfsselectrefhead, which can return an error...

CVE-2026-74321

In the Linux kernel CVE-2026-74321, the bug is in btrfs: __btrfs_run_delayed_refs loop where, if btrfs_select_ref_head() returns ERR_PTR(-EAGAIN), the code previously could end up dereferencing an invalid pointer (locked_ref) after the next iteration. The fix ensures that when an ERR_PTR(-EAGAIN)...

CVE-2026-74311 virtio: rtc: tear down old virtqueues before restore

In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: tear down old virtqueues before restore virtiodevicerestore resets the device and restores the negotiated features before calling -restore. viortcfreeze intentionally leaves the existing virtqueues in place so the...

EUVD-2026-59458

In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: tear down old virtqueues before restore virtiodevicerestore resets the device and restores the negotiated features before calling -restore. viortcfreeze intentionally leaves the existing virtqueues in place so the...

EUVD-2026-59451

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcasetup for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcasetup unconditionally calls serdevdevicegetdrvdatahu-serdev and dereferences th...

CVE-2026-74304 Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcasetup for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcasetup unconditionally calls serdevdevicegetdrvdatahu-serdev and dereferences th...

CVE-2026-74303 Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

CVE-2026-74303

The CVE-2026-74303 issue concerns the Linux kernel Bluetooth stack (hci_qca). A NULL pointer dereference occurs in qca_dmp_hdr() when handling non-serdev devices: hu->serdev is NULL for hci_uart attached via non-serdev paths, yet the function dereferences hu->serdev->dev.driver->name....

CVE-2026-74303 Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

EUVD-2026-59450

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

CVE-2026-74304 Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcasetup for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcasetup unconditionally calls serdevdevicegetdrvdatahu-serdev and dereferences th...

EUVD-2026-59433

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

CVE-2026-74286 net: pfcp: allocate per-cpu tstats for PFCP netdevs

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

CVE-2026-74286

Summary: The CVE-2026-74286 issue affects the Linux kernel PFCP netdevs. The root cause is that PFCP uses dev_get_tstats64() for stats, but pfcp_link_setup() did not request NETDEV_PCPU_STAT_TSTATS, leaving dev->tstats NULL. As a result, creating a PFCP rtnetlink device could prematurely query...

CVE-2026-74274 cxl/region: Fill first free targets[] slot during auto-discovery

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fill first free targets slot during auto-discovery Any invalid endpoint decoder pointer in the target array of an active region is not allowed by cxl driver. This means cxl driver always assumes the first p-nrtargets...

EUVD-2026-59421

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fill first free targets slot during auto-discovery Any invalid endpoint decoder pointer in the target array of an active region is not allowed by cxl driver. This means cxl driver always assumes the first p-nrtargets...