105395 matches found
CVE-2026-74702
CVE-2026-74702 affects the Linux kernel vhost-scsi module. The root cause is that vhost_scsi_set_features() accepts changes to virtio feature bits (specifically VIRTIO_SCSI_F_T10_PI) after the endpoint is already active via VHOST_SCSI_SET_ENDPOINT. This leaves the prot_sgl scatterlist array as NU...
CVE-2026-74702
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhostscsisetupvqcmds runs from VHOSTSCSISETENDPOINT and allocates each command's protection scatterlist array protsgl according to the acknowledged VIRTIOSCSIFT10PI bit. The comma...
CVE-2026-74702 vhost-scsi: reject feature changes after endpoint
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhostscsisetupvqcmds runs from VHOSTSCSISETENDPOINT and allocates each command's protection scatterlist array protsgl according to the acknowledged VIRTIOSCSIFT10PI bit. The comma...
EUVD-2026-64389
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhostscsisetupvqcmds runs from VHOSTSCSISETENDPOINT and allocates each command's protection scatterlist array protsgl according to the acknowledged VIRTIOSCSIFT10PI bit. The comma...
CVE-2026-74680
In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: properly kill rcvurb on error in cxacrucm If cxacrucm encounters an error while submitting or waiting for sndurb, it aborts and returns the error without killing the already submitted rcvurb. This leaves the...
CVE-2026-74680 usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: properly kill rcvurb on error in cxacrucm If cxacrucm encounters an error while submitting or waiting for sndurb, it aborts and returns the error without killing the already submitted rcvurb. This leaves the...
CVE-2026-74680
This vulnerability affects the Linux kernel 's cxacru USB ATM driver (drivers/usb/atm/cxacru.c). The root cause is a missing cleanup in cxacru_cm(): when an error occurs while submitting or waiting for snd_urb, the function returns early without killing the already-submitted rcv_urb, leaving it i...
EUVD-2026-64367
In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: properly kill rcvurb on error in cxacrucm If cxacrucm encounters an error while submitting or waiting for sndurb, it aborts and returns the error without killing the already submitted rcvurb. This leaves the...
CVE-2026-74680 usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: properly kill rcvurb on error in cxacrucm If cxacrucm encounters an error while submitting or waiting for sndurb, it aborts and returns the error without killing the already submitted rcvurb. This leaves the...
CVE-2026-74677
CVE-2026-74677 is a use-after-free in the Linux kernel's ipheth USB network driver. The root cause is that ipheth_sndbulk_callback() re-arms the carrier_work delayed work on any non-zero URB status without checking whether the interface is still up. After ipheth_close() drains the work, a late UR...
EUVD-2026-64364
In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrierwork UAF on disconnect iphethsndbulkcallback re-arms the carrier-check work on any non-zero URB status: else scheduledelayedwork&dev-carrierwork, 0; Nothing ties that to the interface being up, so the...
CVE-2026-74677 net: usb: ipheth: fix carrier_work UAF on disconnect
In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrierwork UAF on disconnect iphethsndbulkcallback re-arms the carrier-check work on any non-zero URB status: else scheduledelayedwork&dev-carrierwork, 0; Nothing ties that to the interface being up, so the...
CVE-2026-74677 net: usb: ipheth: fix carrier_work UAF on disconnect
In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrierwork UAF on disconnect iphethsndbulkcallback re-arms the carrier-check work on any non-zero URB status: else scheduledelayedwork&dev-carrierwork, 0; Nothing ties that to the interface being up, so the...
CVE-2026-74677
In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrierwork UAF on disconnect iphethsndbulkcallback re-arms the carrier-check work on any non-zero URB status: else scheduledelayedwork&dev-carrierwork, 0; Nothing ties that to the interface being up, so the...
CVE-2026-74666
In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packetsetring updates the RX ring state under skreceivequeue.lock, but used to publish the tpacket receive mode through po-prothook.func after releasing that lock...
EUVD-2026-64353
In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packetsetring updates the RX ring state under skreceivequeue.lock, but used to publish the tpacket receive mode through po-prothook.func after releasing that lock...
CVE-2026-74666 packet: synchronize pressure clearing with ring reconfiguration
In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packetsetring updates the RX ring state under skreceivequeue.lock, but used to publish the tpacket receive mode through po-prothook.func after releasing that lock...
CVE-2026-74666 packet: synchronize pressure clearing with ring reconfiguration
In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packetsetring updates the RX ring state under skreceivequeue.lock, but used to publish the tpacket receive mode through po-prothook.func after releasing that lock...
CVE-2026-74666
This vulnerability affects the Linux kernel AF_PACKET (packet socket) subsystem. A race condition exists in packet_set_ring(): the tpacket receive mode was published via po->prot_hook.func after releasing sk_receive_queue.lock, while the RX ring state was already updated under that lock. This ...
CVE-2026-74658
CVE-2026-74658 is a race condition in the Linux kernel robust futex exit handling. When a woken waiter is killed before it can acquire the futex or re-arm FUTEX_WAITERS , and a third task re-acquires the futex via the uncontended fast path, the notification is lost. The new owner sees no FUTEX_WA...