CVE-2026-74392

In the Linux kernel, the following vulnerability has been resolved: dm: limit target bio polling to one shot dmpollbio is the -pollbio callback for a stacked dm device. The caller only knows about the dm queue, so it may decide to do a spinning poll if it thinks a single queue is being polled...

CVE-2026-74384

CVE-2026-74384 details a Linux kernel issue in nvme-multipath where a flexible array member current_path[] in struct nvme_ns_head is indexed by NUMA node IDs but allocated using num_possible_nodes(). On POWER systems with sparse NUMA IDs, this can lead to out-of-bounds accesses. The mitigation is...

CVE-2026-74384 nvme-multipath: fix flex array size in struct nvme_ns_head

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible array member, currentpath, which is indexed using the NUMA node ID: head-currentpathnumanodeid The structure is currently allocated as...

EUVD-2026-59531

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible array member, currentpath, which is indexed using the NUMA node ID: head-currentpathnumanodeid The structure is currently allocated as...

CVE-2026-74384

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible array member, currentpath, which is indexed using the NUMA node ID: head-currentpathnumanodeid The structure is currently allocated as...

CVE-2026-74384 nvme-multipath: fix flex array size in struct nvme_ns_head

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible array member, currentpath, which is indexed using the NUMA node ID: head-currentpathnumanodeid The structure is currently allocated as...

CVE-2026-74384

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible array member, currentpath, which is indexed using the NUMA node ID: head-currentpathnumanodeid The structure is currently allocated as...

CVE-2026-74365 nvdimm/btt: Handle preemption in BTT lane acquisition

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

CVE-2026-74365

The CVE-2026-74365 entry describes a race in BTT lane acquisition inside the Linux kernel’s nvdimm subsystem. A spinlock-based per-lane recursion model could be bypassed when preemption occurred, allowing concurrent use of the same lane and risking silent data corruption during BTT I/O. The fix r...

CVE-2026-74365

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

CVE-2026-74365 nvdimm/btt: Handle preemption in BTT lane acquisition

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

EUVD-2026-59512

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

CVE-2026-74365

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

CVE-2026-74363

The CVE-2026-74363 entry concerns a Linux kernel BPF/bpffs use-after-free related to inode cleanup. The root cause was that moved cleanup from ->free_inode() into ->destroy_inode() to avoid sleeping in RCU when calling bpf_any_put(), which inadvertently removed the RCU delay on freeing the ...

CVE-2026-74363

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 "bpf: Avoid RCU context warning when unpinning htab with internal structs" moved inode cleanup from -freeinode into -destroyinode to avoid sleeping ...

CVE-2026-74363 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 "bpf: Avoid RCU context warning when unpinning htab with internal structs" moved inode cleanup from -freeinode into -destroyinode to avoid sleeping ...

EUVD-2026-59510

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 "bpf: Avoid RCU context warning when unpinning htab with internal structs" moved inode cleanup from -freeinode into -destroyinode to avoid sleeping ...

CVE-2026-74363 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 "bpf: Avoid RCU context warning when unpinning htab with internal structs" moved inode cleanup from -freeinode into -destroyinode to avoid sleeping ...

CVE-2026-74363

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 "bpf: Avoid RCU context warning when unpinning htab with internal structs" moved inode cleanup from -freeinode into -destroyinode to avoid sleeping ...

EUVD-2026-59504

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpucoredump ring dump The ring content dump in amdgpucoredump uses two separate loops over adev-rings: the first counts rings with unsignalled fences to size the allocation, and the...