CVE-2026-74488 wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex11ndispatchamsdupkt splits an A-MSDU with ieee80211amsduto8023s and walks the resulting subframes. For each subframe it passes the subframe data pointe...

CVE-2026-74487 binfmt_misc: restore write access when removing an entry

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: restore write access when removing an entry Registering an entry with the MISCFMTOPENFILE flag opens the interpreter via openexec which denies write access to it for as long as the entry exists. Removing the entry...

CVE-2026-74486

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: use exefiledenywriteaccess for the interpreter clone For MISCFMTOPENFILE entries loadmiscbinary clones the registered interpreter file and denies write access to the clone via plain denywriteaccess. The clone is...

CVE-2026-74486 binfmt_misc: use exe_file_deny_write_access() for the interpreter clone

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: use exefiledenywriteaccess for the interpreter clone For MISCFMTOPENFILE entries loadmiscbinary clones the registered interpreter file and denies write access to the clone via plain denywriteaccess. The clone is...

EUVD-2026-59679

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: use exefiledenywriteaccess for the interpreter clone For MISCFMTOPENFILE entries loadmiscbinary clones the registered interpreter file and denies write access to the clone via plain denywriteaccess. The clone is...

CVE-2026-74486 binfmt_misc: use exe_file_deny_write_access() for the interpreter clone

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: use exefiledenywriteaccess for the interpreter clone For MISCFMTOPENFILE entries loadmiscbinary clones the registered interpreter file and denies write access to the clone via plain denywriteaccess. The clone is...

CVE-2026-74486

The CVE-2026-74486 entry describes a Linux kernel vulnerability in binfmt_misc where load_misc_binary() clones the interpreter file and denies write access with exe_file_deny_write_access(), while the exec path later calls exe_file_allow_write_access(). This mismatch can cause repeated write-deni...

CVE-2026-74486

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: use exefiledenywriteaccess for the interpreter clone For MISCFMTOPENFILE entries loadmiscbinary clones the registered interpreter file and denies write access to the clone via plain denywriteaccess. The clone is...

CVE-2026-74484

CVE-2026-74484 concerns the Linux kernel’s binfmt_misc feature: an entry registered with the character 'F' can cause the interpreter to pin itself, preventing proper unregistration and leading to a DoS with leaked resources (including user namespaces). The issue arises when the interpreter’s file...

EUVD-2026-59677

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't let an 'F' entry pin its own instance An entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed. Any entry nobody removes by hand only gets closed once...

CVE-2026-74485 binfmt_misc: reject a flag character as the field delimiter

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: reject a flag character as the field delimiter The registration string starts with a user chosen delimiter that separates the individual fields. So that the field parsers terminate even on a truncated string createent...

CVE-2026-74484

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't let an 'F' entry pin its own instance An entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed. Any entry nobody removes by hand only gets closed once...

CVE-2026-74484 binfmt_misc: don't let an 'F' entry pin its own instance

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't let an 'F' entry pin its own instance An entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed. Any entry nobody removes by hand only gets closed once...

CVE-2026-74484 binfmt_misc: don't let an 'F' entry pin its own instance

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't let an 'F' entry pin its own instance An entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed. Any entry nobody removes by hand only gets closed once...

CVE-2026-74483 binfmt_misc: don't leak the user namespace when the mount fails

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't leak the user namespace when the mount fails bmgettree takes a reference to the user namespace and hands it to gettreekeyed as the sget key. sgetfc moves that reference into sb-sfsinfo and clears fc-sfsinfo, so...

CVE-2026-74482 mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: unlock immaprwsem before releasing after-split folios foliosplit keeps dereferencing the mapping after the split: shmemunchargemapping-host and remappage while the folios are still frozen/locked, and...

CVE-2026-74481 mm/page_reporting: use system_freezable_wq to fix UAF during suspend

In the Linux kernel, the following vulnerability has been resolved: mm/pagereporting: use systemfreezablewq to fix UAF during suspend During PM freeze e.g. S3 suspend or S4 hibernation, device drivers like virtioballoon reset their underlying virtio devices and delete their virtqueues via...

CVE-2026-74479 net: pktgen: fix proc entry use-after-free

In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix proc entry use-after-free pktgenchangename replaces pktdev-entry while holding t-iflock. pktgenremovedevice removes the same entry before remdevfromiflist takes that lock. This allows the following interleaving:...

CVE-2026-74480 net: bridge: stop fast-leave after deleting a port group

In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group brmulticastleavegroup iterates mp-ports with pp = &p-next in its fast-leave path. After brmulticastdelpg removes p, continuing the loop advances pp through the deleted entr...

CVE-2026-74478 um: vector: fix use-after-free in vector_mmsg_rx()

In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vectormmsgrx When vectormmsgrx discards a packet whose overlay header fails verifyheader, it frees the skb and continues the loop: if headercheck estats.rxencapserrors++; continue; The normal and...