CVE-2026-74384

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible array member, currentpath, which is indexed using the NUMA node ID: head-currentpathnumanodeid The structure is currently allocated as...

CVE-2026-74384 nvme-multipath: fix flex array size in struct nvme_ns_head

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible array member, currentpath, which is indexed using the NUMA node ID: head-currentpathnumanodeid The structure is currently allocated as...

CVE-2026-74384 nvme-multipath: fix flex array size in struct nvme_ns_head

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible array member, currentpath, which is indexed using the NUMA node ID: head-currentpathnumanodeid The structure is currently allocated as...

EUVD-2026-59531

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible array member, currentpath, which is indexed using the NUMA node ID: head-currentpathnumanodeid The structure is currently allocated as...

CVE-2026-74384

CVE-2026-74384 details a Linux kernel issue in nvme-multipath where a flexible array member current_path[] in struct nvme_ns_head is indexed by NUMA node IDs but allocated using num_possible_nodes(). On POWER systems with sparse NUMA IDs, this can lead to out-of-bounds accesses. The mitigation is...

EUVD-2026-59504

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpucoredump ring dump The ring content dump in amdgpucoredump uses two separate loops over adev-rings: the first counts rings with unsignalled fences to size the allocation, and the...

CVE-2026-74357 drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpu_coredump ring dump

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpucoredump ring dump The ring content dump in amdgpucoredump uses two separate loops over adev-rings: the first counts rings with unsignalled fences to size the allocation, and the...

CVE-2026-74357 drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpu_coredump ring dump

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpucoredump ring dump The ring content dump in amdgpucoredump uses two separate loops over adev-rings: the first counts rings with unsignalled fences to size the allocation, and the...

CVE-2026-74357

CVE-2026-74357 (Linux kernel, amdgpu) : The vulnerability arises in the amdgpu_coredump path where two passes over adev->rings[] count and copy ring data using the same skip condition. Because last_seq is updated concurrently by the fence signalling path, rings may transition from signalled to...

CVE-2026-74348 ocfs2/dlm: require a ref for locking_state debugfs open

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: require a ref for lockingstate debugfs open debuglockresopen copies inode-iprivate into struct debuglockres and debuglockresrelease later drops that pointer with dlmput. That only works if open successfully pins the...

EUVD-2026-59492

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix endpoint/socket association handling Disassociating a socket from an endpoint via siwsocketdisassoc may release the last reference on that endpoint and free it. Therefore, don't clear the endpoints socket pointer...

CVE-2026-74345

The CVE-2026-74345 entry describes a Linux kernel vulnerability in the RDMA/siw driver where disassociating a socket from an endpoint may release the last reference to the endpoint, leading to a use-after-free if the endpoint’s socket pointer is cleared after the disassociation. The fix ensures t...

CVE-2026-74333 ASoC: amd: acp-sdw-legacy: Bound DAI link iteration

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-legacy: Bound DAI link iteration createsdwdailinks walks socdais until it finds an entry with initialised cleared, but socdais is allocated with exactly numends entries. If all entries are initialised, the loop...

CVE-2026-74310 vhost/net: complete zerocopy ubufs only once

In the Linux kernel, the following vulnerability has been resolved: vhost/net: complete zerocopy ubufs only once vhost-net initializes one ubufinfo per outstanding zerocopy TX descriptor and hands it to the backend socket. The networking stack may then clone a zerocopy skb before all skb referenc...

EUVD-2026-59392

In the Linux kernel, the following vulnerability has been resolved: net: serialize netifrunning check in enqueuetobacklog Syzbot reported a KASAN slab-use-after-free in fibruleslookup. The root cause is a race condition where packets can escape the backlog flushing during device unregistration...

EUVD-2026-59377

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add bounds check to rungethighestvcn rungethighestvcn parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile UpdateMappingPairs record whose...

CVE-2026-72478 fs/ntfs3: add bounds check to run_get_highest_vcn()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add bounds check to rungethighestvcn rungethighestvcn parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile UpdateMappingPairs record whose...

CVE-2026-72419 netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnat: avoid invalid natnet pointer use on failed nfnatinit We ran into below KASAN splat, which is mostly uninteresting, beside for having nfnatregisterfn in the call chain as a cause for the offending access:...

EUVD-2026-59318

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnat: avoid invalid natnet pointer use on failed nfnatinit We ran into below KASAN splat, which is mostly uninteresting, beside for having nfnatregisterfn in the call chain as a cause for the offending access:...

CVE-2026-72419 netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnat: avoid invalid natnet pointer use on failed nfnatinit We ran into below KASAN splat, which is mostly uninteresting, beside for having nfnatregisterfn in the call chain as a cause for the offending access:...