CVE-2026-74613

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: avoid refilling the RX queue after teardown Commit b917507e5ad9 "vsock/virtio: stop workers during the .remove" made the RX worker jump to its common exit when rxrun is clear. That exit still refills the RX queue wh...

UBUNTU-CVE-2026-74613

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: avoid refilling the RX queue after teardown Commit b917507e5ad9 "vsock/virtio: stop workers during the .remove" made the RX worker jump to its common exit when rxrun is clear. That exit still refills the RX queue wh...

UBUNTU-CVE-2026-74611

In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msgiter before TLS 1.3 optimistic retry tlsdecryptsg advances msg-msgiter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data,...

UBUNTU-CVE-2026-74653

In the Linux kernel, the following vulnerability has been resolved: serial: 8250of: clear stuck empty-FIFO RX-timeout on LPC32xx The NXP LPC32xx UART PORTLPC3220 can latch an RX character-timeout interrupt while the RX FIFO is empty: IIR reports UARTIIRRXTIMEOUT 0x0c but LSR.DR is clear. A...

CVE-2026-74653

In the Linux kernel, the following vulnerability has been resolved: serial: 8250of: clear stuck empty-FIFO RX-timeout on LPC32xx The NXP LPC32xx UART PORTLPC3220 can latch an RX character-timeout interrupt while the RX FIFO is empty: IIR reports UARTIIRRXTIMEOUT 0x0c but LSR.DR is clear. A...

CVE-2026-74626

In the Linux kernel, the following vulnerability has been resolved: NTB: ntbnetdev: Preserve RX queue depth on allocation failure ntbnetdevrxhandler hands the received skb to the network stack before allocating its replacement. If the allocation fails, nothing is reposted. Every failure therefore...

UBUNTU-CVE-2026-74626

In the Linux kernel, the following vulnerability has been resolved: NTB: ntbnetdev: Preserve RX queue depth on allocation failure ntbnetdevrxhandler hands the received skb to the network stack before allocating its replacement. If the allocation fails, nothing is reposted. Every failure therefore...

CVE-2026-74654 serial: 8250_dma: Clear stale RX state on shutdown

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

CVE-2026-74653 serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx

In the Linux kernel, the following vulnerability has been resolved: serial: 8250of: clear stuck empty-FIFO RX-timeout on LPC32xx The NXP LPC32xx UART PORTLPC3220 can latch an RX character-timeout interrupt while the RX FIFO is empty: IIR reports UARTIIRRXTIMEOUT 0x0c but LSR.DR is clear. A...

CVE-2026-74653 serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx

In the Linux kernel, the following vulnerability has been resolved: serial: 8250of: clear stuck empty-FIFO RX-timeout on LPC32xx The NXP LPC32xx UART PORTLPC3220 can latch an RX character-timeout interrupt while the RX FIFO is empty: IIR reports UARTIIRRXTIMEOUT 0x0c but LSR.DR is clear. A...

EUVD-2026-64590

In the Linux kernel, the following vulnerability has been resolved: serial: 8250of: clear stuck empty-FIFO RX-timeout on LPC32xx The NXP LPC32xx UART PORTLPC3220 can latch an RX character-timeout interrupt while the RX FIFO is empty: IIR reports UARTIIRRXTIMEOUT 0x0c but LSR.DR is clear. A...

CVE-2026-74653

CVE-2026-74653 affects the Linux kernel 8250_of serial driver on NXP LPC32xx (PORT_LPC3220) hardware. The UART can latch an RX character-timeout interrupt while the RX FIFO is empty; because the interrupt is level-triggered and re-fires immediately, it causes an interrupt storm that livelocks the...

CVE-2026-74626 NTB: ntb_netdev: Preserve RX queue depth on allocation failure

In the Linux kernel, the following vulnerability has been resolved: NTB: ntbnetdev: Preserve RX queue depth on allocation failure ntbnetdevrxhandler hands the received skb to the network stack before allocating its replacement. If the allocation fails, nothing is reposted. Every failure therefore...

EUVD-2026-64563

In the Linux kernel, the following vulnerability has been resolved: NTB: ntbnetdev: Preserve RX queue depth on allocation failure ntbnetdevrxhandler hands the received skb to the network stack before allocating its replacement. If the allocation fails, nothing is reposted. Every failure therefore...

CVE-2026-74626

CVE-2026-74626 affects the Linux kernel's Non-Transparent Bridge (NTB) virtual ethernet driver (ntb_netdev). The root cause is in ntb_netdev_rx_handler(), which hands the received skb to the network stack before allocating its replacement. When the allocation fails, the buffer is not reposted, so...

CVE-2026-74626 NTB: ntb_netdev: Preserve RX queue depth on allocation failure

In the Linux kernel, the following vulnerability has been resolved: NTB: ntbnetdev: Preserve RX queue depth on allocation failure ntbnetdevrxhandler hands the received skb to the network stack before allocating its replacement. If the allocation fails, nothing is reposted. Every failure therefore...

CVE-2026-74622

CVE-2026-74622 is a resource leak in the Linux kernel's Aquantia (AQC) atlantic network driver. The function aq_ring_rx_deinit() only iterates over the [sw_head, sw_tail) region of the RX ring, but since the page reuse strategy was introduced, consumed-but-not-yet-refilled buffers reside in the c...

CVE-2026-74622 net: atlantic: free RX pages of consumed but not refilled buffers

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aqringrxdeinit only walks swhead, swtail, the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page and its DMA...

EUVD-2026-64559

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aqringrxdeinit only walks swhead, swtail, the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page and its DMA...

CVE-2026-74622 net: atlantic: free RX pages of consumed but not refilled buffers

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aqringrxdeinit only walks swhead, swtail, the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page and its DMA...