CVE-2026-74723

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers BUG For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: BUG: KASAN: slab-out-of-bounds in...

CVE-2026-74711

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbusnotify, the code unconditionally casts every attribute to a struct sensordeviceattribute:...

CVE-2026-74689

In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vccsetsockopt vccsetsockopt contained an ineffective optlen check: if SOLEVELMATCHoptname, level && optlen != SOSIZEoptname return -EINVAL; If SOLEVELMATCHoptname, level evaluated to false...

CVE-2026-74640

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: fix OOB write in fcpmeterctlget fcpioctlsetmetermap bounds the user-supplied Level Meter map size by the driver's own limit of 255 if map.mapsize 255 || map.meterslots 255 return -EINVAL; and passes it to fcpaddnewctl ...

EUVD-2026-64410

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers BUG For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: BUG: KASAN: slab-out-of-bounds in...

EUVD-2026-64399

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 mlx5core Read of size 272 at addr 0000000176795020 by task...

CVE-2026-74712

CVE-2026-74712 is a slab-out-of-bounds read in the Linux kernel mlx5_vdpa driver, specifically in the create_direct_keys() function. The root cause is a size calculation mismatch: the input buffer length passed to cmd_exec includes the full structure size (out + in + mtt[]), but the pointer point...

CVE-2026-74712 vdpa/mlx5: Fix buffer length in create_direct_keys()

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 mlx5core Read of size 272 at addr 0000000176795020 by task...

EUVD-2026-64398

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbusnotify, the code unconditionally casts every attribute to a struct sensordeviceattribute:...

CVE-2026-74711

CVE-2026-74711 is a type confusion vulnerability in the Linux kernel's hwmon pmbus driver (drivers/hwmon/pmbus/pmbus_core.c). In pmbus_notify(), the code unconditionally casts every attribute to struct sensor_device_attribute, but data->group.attrs may contain other types such as struct pmbus_...

EUVD-2026-64376

In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vccsetsockopt vccsetsockopt contained an ineffective optlen check: if SOLEVELMATCHoptname, level && optlen != SOSIZEoptname return -EINVAL; If SOLEVELMATCHoptname, level evaluated to false...

CVE-2026-74689 net/atm: fix slab-out-of-bounds read in vcc_setsockopt()

In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vccsetsockopt vccsetsockopt contained an ineffective optlen check: if SOLEVELMATCHoptname, level && optlen != SOSIZEoptname return -EINVAL; If SOLEVELMATCHoptname, level evaluated to false...

CVE-2026-74689

CVE-2026-74689 is a slab-out-of-bounds read in the Linux kernel's net/atm subsystem, specifically in vcc_setsockopt(). The root cause is an ineffective optlen validation: when __SO_LEVEL_MATCH(optname, level) evaluates to false, the length check is short-circuited and bypassed, allowing copy_from...

EUVD-2026-64577

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: fix OOB write in fcpmeterctlget fcpioctlsetmetermap bounds the user-supplied Level Meter map size by the driver's own limit of 255 if map.mapsize 255 || map.meterslots 255 return -EINVAL; and passes it to fcpaddnewctl ...

CVE-2026-74640 ALSA: FCP: fix OOB write in fcp_meter_ctl_get()

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: fix OOB write in fcpmeterctlget fcpioctlsetmetermap bounds the user-supplied Level Meter map size by the driver's own limit of 255 if map.mapsize 255 || map.meterslots 255 return -EINVAL; and passes it to fcpaddnewctl ...

CVE-2026-74640

CVE-2026-74640 is an out-of-bounds write in the Linux kernel's ALSA FCP driver, specifically in fcp_meter_ctl_get(). The driver accepts a Level Meter map size up to 255 , but the kernel's snd_ctl_elem_value integer array is only 128 elements long. The store loop writes one 64-bit word per channel...

CVE-2026-74625 netfilter: bridge: release template ct on non-IP path

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nfctbridgepre sees it. For non-IPv4 and non-IPv6 EtherTypes, nfctbridgepre currently...

EUVD-2026-64552

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlanchangelink arms vxlan-agetimer whenever the requested ageing interval differs from the configured one: if conf.ageinterval != vxlan-cfg.ageinterval...

EUVD-2026-64525

In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk-transport in step with the list it is queued on sctpoutqflushrtx moves a gap-acked chunk onto another transport's transmitted list without updating chunk-transport: if chunk-tsngapacked...

CVE-2026-74588

This is a slab-use-after-free vulnerability in the Linux kernel SCTP subsystem . The root cause is in __sctp_outq_flush_rtx(), which moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport. When the original transport is removed via an ASCONF Delete-...