CVE-2026-74290 net/sched: cls_flow: Dont expose folded kernel pointers

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsflow: Dont expose folded kernel pointers The flow classifier falls back to addrfold for fields that are missing from packet headers. In map mode, userspace controls mask, xor, rshift, addend and divisor, and can...

EUVD-2026-59437

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsflow: Dont expose folded kernel pointers The flow classifier falls back to addrfold for fields that are missing from packet headers. In map mode, userspace controls mask, xor, rshift, addend and divisor, and can...

CVE-2026-74286 net: pfcp: allocate per-cpu tstats for PFCP netdevs

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

EUVD-2026-59433

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

CVE-2026-74286

Summary: The CVE-2026-74286 issue affects the Linux kernel PFCP netdevs. The root cause is that PFCP uses dev_get_tstats64() for stats, but pfcp_link_setup() did not request NETDEV_PCPU_STAT_TSTATS, leaving dev->tstats NULL. As a result, creating a PFCP rtnetlink device could prematurely query...

CVE-2026-74286 net: pfcp: allocate per-cpu tstats for PFCP netdevs

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

CVE-2026-74274 cxl/region: Fill first free targets[] slot during auto-discovery

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fill first free targets slot during auto-discovery Any invalid endpoint decoder pointer in the target array of an active region is not allowed by cxl driver. This means cxl driver always assumes the first p-nrtargets...

CVE-2026-74274

The CVE-2026-74274 entry concerns the Linux kernel cxl/region auto-discovery logic. A NULL hole in a region’s target array (introduced when an endpoint decoder is removed or detached) could lead to null dereferences (possible Oops: general protection fault) or miscounting targets when lock flags ...

CVE-2026-74274 cxl/region: Fill first free targets[] slot during auto-discovery

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fill first free targets slot during auto-discovery Any invalid endpoint decoder pointer in the target array of an active region is not allowed by cxl driver. This means cxl driver always assumes the first p-nrtargets...

EUVD-2026-59421

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fill first free targets slot during auto-discovery Any invalid endpoint decoder pointer in the target array of an active region is not allowed by cxl driver. This means cxl driver always assumes the first p-nrtargets...

CVE-2026-74266

The CVE-2026-74266 family documents a Linux kernel vulnerability in net/sched sch_dualpi2 where qdisc_tree_reduce_backlog is invoked during peek before the queue length (qlen) is restored. This causes a race where, if qlen drops to zero but a packet remains, the parent’s qlen_notify callback can ...

CVE-2026-74266 net/sched: sch_dualpi2: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen

In the Linux kernel, the following vulnerability has been resolved: net/sched: schdualpi2: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever dualpi2 drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog befo...

EUVD-2026-59413

In the Linux kernel, the following vulnerability has been resolved: net/sched: schdualpi2: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever dualpi2 drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog befo...

CVE-2026-74263

The CVE affects the Linux kernel net: wwan: t7xx driver. In t7xx_port_ctrl_tx, each skb fragment is cloned and the clone is immediately used to set cloned->len; if skb_clone() fails, a NULL pointer dereference can occur. The fix checks the clone before using it and, when previous fragments are...

CVE-2026-74263 net: wwan: t7xx: check skb_clone in control TX

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: check skbclone in control TX t7xxportctrltx clones each skb fragment before passing it to the port transmit path. The clone is used immediately to set cloned-len, so an skbclone failure results in a NULL pointer...

EUVD-2026-59410

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: check skbclone in control TX t7xxportctrltx clones each skb fragment before passing it to the port transmit path. The clone is used immediately to set cloned-len, so an skbclone failure results in a NULL pointer...

CVE-2026-74263 net: wwan: t7xx: check skb_clone in control TX

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: check skbclone in control TX t7xxportctrltx clones each skb fragment before passing it to the port transmit path. The clone is used immediately to set cloned-len, so an skbclone failure results in a NULL pointer...

CVE-2026-74262

In the Linux kernel, CVE-2026-74262 affects the kernel networking path used by KCM. kcm_attach() replaces a live lower TCP socket’s sk_data_ready and sk_write_space callbacks with KCM handlers, and kcm_unattach() restores them later. These updates were plain stores and could be observed by other ...

CVE-2026-74259 cifs: remove all cifs files before kill super

In the Linux kernel, the following vulnerability has been resolved: cifs: remove all cifs files before kill super Cifs files may be put into fileinfoputwq during umounting cifs. After umount done, cifsFileInfoputfinal is called, which cause following BUG: BUG: kernel NULL pointer dereference,...

EUVD-2026-59406

In the Linux kernel, the following vulnerability has been resolved: cifs: remove all cifs files before kill super Cifs files may be put into fileinfoputwq during umounting cifs. After umount done, cifsFileInfoputfinal is called, which cause following BUG: BUG: kernel NULL pointer dereference,...