CVE-2026-74674

In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zappterange reclaims a page table, it does: ptefreetlbtlb, pmdpgtablepmdval, addr; and this is unconditionally wrong: if this code executes, addr always points one...

CVE-2026-74674 mm: fix incorrect flush address in direct page table reclaim

In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zappterange reclaims a page table, it does: ptefreetlbtlb, pmdpgtablepmdval, addr; and this is unconditionally wrong: if this code executes, addr always points one...

CVE-2026-74674 mm: fix incorrect flush address in direct page table reclaim

In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zappterange reclaims a page table, it does: ptefreetlbtlb, pmdpgtablepmdval, addr; and this is unconditionally wrong: if this code executes, addr always points one...

EUVD-2026-64361

In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zappterange reclaims a page table, it does: ptefreetlbtlb, pmdpgtablepmdval, addr; and this is unconditionally wrong: if this code executes, addr always points one...

CVE-2026-74674

This vulnerability affects the Linux kernel 's memory management (mm) subsystem, specifically the zap_pte_range function. When reclaiming a page table, the function calls pte_free_tlb with an addr parameter that always points one past the end of the table's range, causing the TLB flush to target ...

CVE-2026-74650 staging: rtl8723bs: fix OOB read in WMM_param_handler()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

CVE-2026-74650 staging: rtl8723bs: fix OOB read in WMM_param_handler()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

EUVD-2026-64587

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

CVE-2026-74650

CVE-2026-74650 is an out-of-bounds read in the Linux kernel's staging: rtl8723bs driver. The function WMM_param_handler() copies a fixed 18-byte WMM parameter element from a received information element without validating that the element length is at least 24 bytes. Two of its three callers (OnA...

CVE-2026-74650

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

EUVD-2026-64582

In the Linux kernel, the following vulnerability has been resolved: mm/damon/lrusort: error out for 10000 activemembp damosquotascore can trigger division by zero if the target value is zero. DAMONLRUSORT lets users set the target value for the hot memory scheme via activemembp parameter. It avoi...

CVE-2026-74645

CVE-2026-74645 is a division-by-zero vulnerability in the Linux kernel's DAMON_LRU_SORT module. When a user sets the active_mem_bp parameter to 10002 , the cold memory scheme's quota goal target value becomes zero, causing damos_quota_score() to trigger a kernel oops (divide error). The fix retur...

CVE-2026-74645 mm/damon/lru_sort: error out for >10000 active_mem_bp

In the Linux kernel, the following vulnerability has been resolved: mm/damon/lrusort: error out for 10000 activemembp damosquotascore can trigger division by zero if the target value is zero. DAMONLRUSORT lets users set the target value for the hot memory scheme via activemembp parameter. It avoi...

CVE-2026-74645

In the Linux kernel, the following vulnerability has been resolved: mm/damon/lrusort: error out for 10000 activemembp damosquotascore can trigger division by zero if the target value is zero. DAMONLRUSORT lets users set the target value for the hot memory scheme via activemembp parameter. It avoi...

CVE-2026-74645 mm/damon/lru_sort: error out for >10000 active_mem_bp

In the Linux kernel, the following vulnerability has been resolved: mm/damon/lrusort: error out for 10000 activemembp damosquotascore can trigger division by zero if the target value is zero. DAMONLRUSORT lets users set the target value for the hot memory scheme via activemembp parameter. It avoi...

CVE-2026-74643 samples/damon/mtier: error out for zero quota goal target values

In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: error out for zero quota goal target values Patch series "mm/damon: avoid division by zero from damosquotascore". DAMONSAMPLEMTIER and DAMONLRUSORT allow the user to trigger division by zero in damosquotascor...

CVE-2026-74643 samples/damon/mtier: error out for zero quota goal target values

In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: error out for zero quota goal target values Patch series "mm/damon: avoid division by zero from damosquotascore". DAMONSAMPLEMTIER and DAMONLRUSORT allow the user to trigger division by zero in damosquotascor...

CVE-2026-74643

CVE-2026-74643 is a division-by-zero vulnerability in the Linux kernel affecting the DAMON_SAMPLE_MTIER and DAMON_LRU_SORT modules. The root cause is that damos_quota_score() does not guard against a zero target_value, which users can set via the node0_mem_{used,free}_bp sysfs parameters. Trigger...

EUVD-2026-64580

In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: error out for zero quota goal target values Patch series "mm/damon: avoid division by zero from damosquotascore". DAMONSAMPLEMTIER and DAMONLRUSORT allow the user to trigger division by zero in damosquotascor...

CVE-2026-74643

In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: error out for zero quota goal target values Patch series "mm/damon: avoid division by zero from damosquotascore". DAMONSAMPLEMTIER and DAMONLRUSORT allow the user to trigger division by zero in damosquotascor...