CVE-2026-74438

In the Linux kernel, the following vulnerability has been resolved: crypto: sun4i-ss - Remove insecure and unused rngalg Remove sun4issrng, as it is insecure and unused: - It has multiple vulnerabilities. sun4issprngseed is missing locking and has a buffer overflow. sun4issprnggenerate fails to...

CVE-2026-74436

In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpckernelchargeaccept reads rx-backlog without any socket/backlog synchronization and passes that raw pointer into rxrpcservicepreallocone. A concurrent...

CVE-2026-74434

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpcrecvmsgoob takes a received oob message off recvmsgoobq and, if a response is needed, moves it onto the pendingoobq tree. However, only the unlink from recvmsgoob...

CVE-2026-74432

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix leak of released call in recvmsgMSGPEEK Fix rxrpcrecvmsg to also drop the ref it holds on an already-released call if MSGPEEK is in force the function holds a ref on the call irrespective of whether MSGPEEK is specifie...

CVE-2026-74430

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...

CVE-2026-74428

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix double unlock in rxrpcrecvmsg Fix a double unlock in rxrpcrecvmsg when dealing with OOB messages...

CVE-2026-74427

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls a...

CVE-2026-74426

In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afsgettree afsallocsbi uses kzalloc for memory allocation. And, if ctx-dynroot is not null, as-cell and as-volume are null. In traceafsgettree they are dereferenced. KASAN error message: KASAN...

CVE-2026-74424

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vcdata fbconnewmodelist runs when a framebuffer's modelist changes. For each console mapped to it with fbdisplayi.mode set, it reads vcconsi.d and passes the vcnum to...

CVE-2026-74422

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: inno-hdmi: Switch to drmmkzalloc Driver makes use of drmmencoderinit to initialize the encoder and automatically handle the cleanup by registering drmencodercleanup with drmmaddaction. However, the internal structur...

CVE-2026-74419

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Adjust size for copytouser The amount of data returned to user space should be limited by the buffer size provided by the application. If the buffer is smaller than the data size, return only the portion that fits...

CVE-2026-74420

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Reject VMAs with VMIO or VMPFNMAP when creating SVM ranges VMAs marked with VMIO or VMPFNMAP are not backed by struct page objects, which GPUSVM requires in order to operate correctly. In particular, getpages relies o...

CVE-2026-74418

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Fix potential tracepoint null pointer dereferences Tracedmafencesignaled, tracedmafencewaitend and tracedmafencedestroy can all currently dereference a null fence-ops pointer after it has been reset on fence signalling...

CVE-2026-74416

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix memory leak in radeonringrestore on lock failure radeonringrestore takes ownership of the data buffer allocated by radeonringbackup. The caller radeongpureset only frees it in the non-restore branch; in the restor...

CVE-2026-74417

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix integer overflow in radeonalignpitch radeonalignpitch has the same kind of overflow issue as the old amdgpu helper: both the alignment round-up add and the final 'aligned cpp' calculation can overflow signed int. ...

CVE-2026-74414

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Remove the duplicate attr inode dirty marking action Syzbot reported a null-ptr-deref in 1. If the attributes file is not loaded during system mount, a trigger occurs 1 when setxattr is executed in userspace. Remove the...

CVE-2026-74413

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix wrong pcigetdrvdata type in AER handlers rtw89 stores an ieee80211hw pointer via pcisetdrvdata at probe time, but ioerrordetected and ioresume retrieve it as a netdevice pointer. This causes...

CVE-2026-74411

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89hwscanaddchanax for over 20 seconds, leading to a system...

CVE-2026-74410

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer In rtwpcirxnapi, newlen is computed as the sum of pktlen 14-bit descriptor field, max 16383 and pktoffset drvinfosz + shift, both firmware-controlled. The...

CVE-2026-74409

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware macid in link lookup The macid field in RX descriptors is 8 bits wide 0-255, but assoclinkonmacid has only RTW89MAXMACIDNUM 128 entries. While the driver currently assigns macid values...