CVE-2026-74712

CVE-2026-74712 is a slab-out-of-bounds read in the Linux kernel's vdpa/mlx5 driver. The create_direct_keys() function incorrectly calculates the input buffer size by including the entire structure (out + in + mtt[]) while the pointer passed to cmd_exec targets only the in field. This causes mlx5_...

EUVD-2026-64399

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 mlx5core Read of size 272 at addr 0000000176795020 by task...

CVE-2026-74712 vdpa/mlx5: Fix buffer length in create_direct_keys()

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 mlx5core Read of size 272 at addr 0000000176795020 by task...

CVE-2026-74712 vdpa/mlx5: Fix buffer length in create_direct_keys()

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 mlx5core Read of size 272 at addr 0000000176795020 by task...

EUVD-2026-64398

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbusnotify, the code unconditionally casts every attribute to a struct sensordeviceattribute:...

CVE-2026-74711

A type confusion vulnerability in the Linux kernel's hwmon/pmbus driver (drivers/hwmon/pmbus/pmbus_core.c) arises in pmbus_notify(), which unconditionally casts every attribute in data->group.attrs to struct sensor_device_attribute. When the attribute is actually a struct pmbus_samples_reg, th...

CVE-2026-74711 hwmon: (pmbus) Fix type confusion in notification logic

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbusnotify, the code unconditionally casts every attribute to a struct sensordeviceattribute:...

EUVD-2026-64376

In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vccsetsockopt vccsetsockopt contained an ineffective optlen check: if SOLEVELMATCHoptname, level && optlen != SOSIZEoptname return -EINVAL; If SOLEVELMATCHoptname, level evaluated to false...

CVE-2026-74689 net/atm: fix slab-out-of-bounds read in vcc_setsockopt()

In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vccsetsockopt vccsetsockopt contained an ineffective optlen check: if SOLEVELMATCHoptname, level && optlen != SOSIZEoptname return -EINVAL; If SOLEVELMATCHoptname, level evaluated to false...

CVE-2026-74689

A slab-out-of-bounds read vulnerability in the Linux kernel's ATM (Asynchronous Transfer Mode) network protocol, specifically in vcc_setsockopt(). The root cause is an ineffective optlen check: when __SO_LEVEL_MATCH evaluates to false, the length validation is short-circuited and bypassed. Additi...

CVE-2026-74689 net/atm: fix slab-out-of-bounds read in vcc_setsockopt()

In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vccsetsockopt vccsetsockopt contained an ineffective optlen check: if SOLEVELMATCHoptname, level && optlen != SOSIZEoptname return -EINVAL; If SOLEVELMATCHoptname, level evaluated to false...

EUVD-2026-64577

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: fix OOB write in fcpmeterctlget fcpioctlsetmetermap bounds the user-supplied Level Meter map size by the driver's own limit of 255 if map.mapsize 255 || map.meterslots 255 return -EINVAL; and passes it to fcpaddnewctl ...

CVE-2026-74640 ALSA: FCP: fix OOB write in fcp_meter_ctl_get()

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: fix OOB write in fcpmeterctlget fcpioctlsetmetermap bounds the user-supplied Level Meter map size by the driver's own limit of 255 if map.mapsize 255 || map.meterslots 255 return -EINVAL; and passes it to fcpaddnewctl ...

CVE-2026-74640

This is an out-of-bounds write in the Linux kernel's ALSA FCP (FireWire Control Protocol) driver, specifically in fcp_meter_ctl_get(). The root cause is a mismatch: fcp_ioctl_set_meter_map() permits a Level Meter map size up to 255 , but the destination buffer struct snd_ctl_elem_value declares l...

CVE-2026-74640 ALSA: FCP: fix OOB write in fcp_meter_ctl_get()

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: fix OOB write in fcpmeterctlget fcpioctlsetmetermap bounds the user-supplied Level Meter map size by the driver's own limit of 255 if map.mapsize 255 || map.meterslots 255 return -EINVAL; and passes it to fcpaddnewctl ...

CVE-2026-74625 netfilter: bridge: release template ct on non-IP path

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nfctbridgepre sees it. For non-IPv4 and non-IPv6 EtherTypes, nfctbridgepre currently...

EUVD-2026-64552

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlanchangelink arms vxlan-agetimer whenever the requested ageing interval differs from the configured one: if conf.ageinterval != vxlan-cfg.ageinterval...

EUVD-2026-64525

In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk-transport in step with the list it is queued on sctpoutqflushrtx moves a gap-acked chunk onto another transport's transmitted list without updating chunk-transport: if chunk-tsngapacked...

CVE-2026-74588 sctp: keep chunk->transport in step with the list it is queued on

In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk-transport in step with the list it is queued on sctpoutqflushrtx moves a gap-acked chunk onto another transport's transmitted list without updating chunk-transport: if chunk-tsngapacked...

CVE-2026-74588

CVE-2026-74588 is a use-after-free in the Linux kernel's SCTP implementation. In __sctp_outq_flush_rtx(), a gap-acked chunk is moved to another transport's transmitted list via list_move_tail() without updating chunk->transport. If the original transport is freed (triggered by an ASCONF Delete...