CVE-2026-74646

CVE-2026-74646 is a locking bug in the Linux kernel's FastRPC driver (misc/fastrpc). When an invoke is interrupted by a signal, fastrpc_internal_invoke() moves buffers from fl->mmaps onto cctx->invoke_interrupted_mmaps via list_del()/list_add_tail() without holding fl->lock , which is th...

CVE-2026-74638

CVE-2026-74638 affects the V3D DRM scheduler in the Linux kernel, used on hardware such as the Raspberry Pi 5 . The V3D GPU exposes multiple independent hardware queues (BIN, RENDER, TFU, CSD) but performs only a single global reset . When a timeout on one queue triggers a global reset while anot...

EUVD-2026-64575

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Serialize the scheduler timeout handlers V3D exposes several independent hardware queues BIN, RENDER, TFU and CSD but has only a single, global reset. A timeout on any one queue therefore has to stop, reset and restart t...

CVE-2026-74638 drm/v3d: Serialize the scheduler timeout handlers

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Serialize the scheduler timeout handlers V3D exposes several independent hardware queues BIN, RENDER, TFU and CSD but has only a single, global reset. A timeout on any one queue therefore has to stop, reset and restart t...

EUVD-2026-64573

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between updateeventfields and, eventdefinefields The following sequence may leads race between eventdefinefields and updateeventfields: CPU0 loads module A CPU1 loads module B ===============================...

CVE-2026-74636

CVE-2026-74636 is a race condition in the Linux kernel tracing subsystem. When two modules are loaded concurrently on different CPUs, event_define_fields() and update_event_fields() can access class->fields simultaneously without proper mutual exclusion. Specifically, trace_event_update_all() ...

CVE-2026-74636 tracing: Fix race between update_event_fields and, event_define_fields

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between updateeventfields and, eventdefinefields The following sequence may leads race between eventdefinefields and updateeventfields: CPU0 loads module A CPU1 loads module B ===============================...

CVE-2026-74632 mm/huge_memory: fix huge_zero_pfn race

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: fix hugezeropfn race Patch series "mm/hugememory: fix hugezeropfn race", v2. There is a subtle race in the reference-counted hugezerofolio implementation. The fast path atomic logic fails to account for the fact th...

EUVD-2026-64569

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: fix hugezeropfn race Patch series "mm/hugememory: fix hugezeropfn race", v2. There is a subtle race in the reference-counted hugezerofolio implementation. The fast path atomic logic fails to account for the fact th...

CVE-2026-74632

CVE-2026-74632 is a race condition in the Linux kernel mm/huge_memory subsystem affecting the reference-counted huge_zero_folio implementation. The shrinker (shrink_huge_zero_folio_scan()) can overwrite huge_zero_pfn with the ~0UL sentinel value after a concurrent get_huge_zero_folio() has alread...

EUVD-2026-64551

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b "vsock/virtio: add support for device suspend/resume" made the run flags transition from false to true when restore installs replacement virtqueues. The RX, TX...

CVE-2026-74614 vsock/virtio: read virtqueues under worker locks

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b "vsock/virtio: add support for device suspend/resume" made the run flags transition from false to true when restore installs replacement virtqueues. The RX, TX...

CVE-2026-74614

CVE-2026-74614 is a race condition in the Linux kernel's virtio-vsock driver. The issue was introduced by commit bd50c5dc182b, which added device suspend/resume support. During freeze and restore, the *_run flags transition from false to true when replacement virtqueues are installed. However, th...

CVE-2026-74609

CVE-2026-74609 is a use-after-free vulnerability in the Linux kernel's TIPC subsystem, specifically in tipc_node_link_down() (net/tipc/node.c). The function caches the le->link pointer before acquiring the node write lock, while a concurrent delete=true caller (triggered via TIPC_NL_BEARER_DIS...

EUVD-2026-64546

In the Linux kernel, the following vulnerability has been resolved: tipc: read le-link under the node lock in tipcnodelinkdown tipcnodelinkdown caches the link pointer before taking n-lock: struct tipclink l = le-link; / unlocked / if !l return; tipcnodewritelockn; if !tipclinkisestablishingl /...

CVE-2026-74608

CVE-2026-74608 is a use-after-free vulnerability in the Linux kernel CIFS (SMB client) subsystem, specifically in the function cifs_try_adding_channels(). The root cause is an incorrect ordering of reference-count operations: on the failure path of cifs_ses_add_channel(), the temporary reference ...

CVE-2026-74607

CVE-2026-74607 affects the Linux kernel KVM SVM (SEV) subsystem. A race condition between KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM causes two issues: (1) sev_migrate_from() moves a mirror entry to the owner's list without holding the owner's lock, allowing a concurren...

CVE-2026-74607 KVM: SVM: Serialize accesses to the owner and mirror list with separate lock

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Interaction between KVMCAPVMMOVEENCCONTEXTFROM and KVMCAPVMCOPYENCCONTEXTFROM can cause two separate issues: - in sevmigratefrom, when the destination K...

EUVD-2026-64544

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Interaction between KVMCAPVMMOVEENCCONTEXTFROM and KVMCAPVMCOPYENCCONTEXTFROM can cause two separate issues: - in sevmigratefrom, when the destination K...

CVE-2026-74605

CVE-2026-74605 is a race condition in the Linux kernel's eventfs subsystem. The ei->list field is a union with the RCU list head; when an eventfs inode is freed, it is added to the SRCU link list via that same field. Because the list is iterated under SRCU protection without holding eventfs_mu...