CVE-2026-72464

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdmawcreceive decrements the transport's Receive count for every completion before it dispatches a successful Receive to rpcrdmareplyhandler. The handler must post a...

UBUNTU-CVE-2026-74265

In the Linux kernel, the following vulnerability has been resolved: net: mana: initialize gdma queue id to INVALIDQUEUEID managdcreatemanawqcq leaves queue-id as 0 from kzallocobj until manacreatewqobj assigns the firmware-returned id. If creation fails before that, cleanup calls managddestroycq...

CVE-2026-72466

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounded peek rpcrdmaisbcall decodes a reply's first words to decide whether the frame is a backchannel call. Two issues in that decode path let a short or malformed reply leak the receive buffer...

UBUNTU-CVE-2026-74431

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential infinite loop in rxrpcrecvmsg Fix the wait in rxrpcrecvmsg also take check the oob queue...

UBUNTU-CVE-2026-74285

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netifrxqcleanupunlease tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA...

UBUNTU-CVE-2026-74429

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the reception of a reply packet before data transmission Fix rxrpcreceivingreply to handle the reception of an apparent reply DATA packet before rxrpc has had a chance to send any request DATA packets on a client call ...

UBUNTU-CVE-2026-72073

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: fix use-after-free on probe failure The vub300 driver lifetime-manages its controller state using vub300-kref, with vub300delete freeing the mmc host when the last reference is dropped. The probe error path after the...

UBUNTU-CVE-2026-72131

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Prevent shared tags across queues on Apple A11 On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag...

CVE-2026-72056

In the Linux kernel, the following vulnerability has been resolved: net: ena: clean up XDP TX queues when regular TX setup fails createqueueswithsizebackoff creates XDP TX queues before setting up the regular TX path. If the subsequent allocation or creation of regular TX queues fails, the error...

EUVD-2026-59578

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential infinite loop in rxrpcrecvmsg Fix the wait in rxrpcrecvmsg also take check the oob queue...

CVE-2026-74431

The CVE-2026-74431 entry affects the Linux kernel’s rxrpc path. The vulnerability is described as a potential infinite loop in rxrpc_recvmsg(), with a fix that also makes the wait path check the oob queue. The issue is addressed by applying the kernel patches (e.g., the commits listed in the refe...

CVE-2026-74431

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential infinite loop in rxrpcrecvmsg Fix the wait in rxrpcrecvmsg also take check the oob queue...

EUVD-2026-59576

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the reception of a reply packet before data transmission Fix rxrpcreceivingreply to handle the reception of an apparent reply DATA packet before rxrpc has had a chance to send any request DATA packets on a client call ...

CVE-2026-74429

CVE-2026-74429 describes a Linux kernel issue in rxrpc where a reply DATA packet can be received before the client has sent any request DATA packets, potentially causing an oops in rxrpc_rotate_tx_window. The fix updates rxrpc_receiving_reply() to detect an apparent reply before exposure of the c...

CVE-2026-74412

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pcigetdrvdata type in AER handlers rtw88 stores an ieee80211hw pointer via pcisetdrvdata at probe time, but ioerrordetected and ioresume retrieve it as a netdevice pointer. This causes...

CVE-2026-74408 wifi: ath9k: fix OOB access from firmware tx status queue ID

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...

EUVD-2026-59555

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...

CVE-2026-74408

The Linux kernel WiFi driver ath9k has a vulnerability (CVE-2026-74408) where ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] with ts.qid being a 4-bit field (0-15) while the txq array supports only ATH9K_NUM_TX_QUEUES (10). A qid of 10 or higher causes an out-of-bounds access. The documente...

CVE-2026-74408 wifi: ath9k: fix OOB access from firmware tx status queue ID

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...

CVE-2026-74401 dlm: fix add msg handle in send_queue ordered

In the Linux kernel, the following vulnerability has been resolved: dlm: fix add msg handle in sendqueue ordered In a benchmark scenario triggering a lot of requests that triggers a lot of DLM messages on the network it can be that the mh-seq is not ordered according the oldest seq number. This...