CVE-2026-74731 sched_ext: Skip sub-disable teardown for never-linked sub-schedulers

In the Linux kernel, the following vulnerability has been resolved: schedext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scxlinksched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs th...

EUVD-2026-64413

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primaryispromisc under RTNL in bondalbmonitor bondalbmonitor reads primaryispromisc under RCU, then drops RCU and takes RTNL via rtnltrylock before undoing the promiscuity it set on the active slave. In tha...

CVE-2026-74727

CVE-2026-74727 is a race condition in the Linux kernel ovpn (OpenVPN) module that leads to a Use-After-Free (UAF) . The root cause is a TOCTOU window in ovpn_nl_peer_set_doit() and ovpn_peer_endpoints_update(): a peer resolved by ID can be concurrently removed (via OVPN_CMD_PEER_DEL, keepalive ex...

CVE-2026-74726 bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primaryispromisc under RTNL in bondalbmonitor bondalbmonitor reads primaryispromisc under RCU, then drops RCU and takes RTNL via rtnltrylock before undoing the promiscuity it set on the active slave. In tha...

CVE-2026-74726

CVE-2026-74726 is a race condition in the Linux kernel's bonding driver (ALB mode), specifically in bond_alb_monitor(). The function reads primary_is_promisc under RCU, then drops RCU and acquires RTNL via rtnl_trylock(). In that window the active slave can change (e.g., via RTM_DELLINK), causing...

CVE-2026-74727 ovpn: skip rehash for peers already removed from by_id

In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from byid ovpnnlpeersetdoit resolves the target peer via ovpnpeergetbyid before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequent...

EUVD-2026-64414

In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from byid ovpnnlpeersetdoit resolves the target peer via ovpnpeergetbyid before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequent...

EUVD-2026-64412

In the Linux kernel, the following vulnerability has been resolved: enic: fix txhangreset use-after-free on device removal enicremove cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that fires while the device is being removed can schedule enictxhangreset s...

CVE-2026-74725

This CVE affects the enic network driver in the Linux kernel . The root cause is a use-after-free in the tx_hang_reset work item during device removal: enic_remove() cancels the reset and change_mtu_work items but fails to cancel tx_hang_reset. A TX timeout firing while the device is being remove...

CVE-2026-74725 enic: fix tx_hang_reset use-after-free on device removal

In the Linux kernel, the following vulnerability has been resolved: enic: fix txhangreset use-after-free on device removal enicremove cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that fires while the device is being removed can schedule enictxhangreset s...

CVE-2026-74698

This vulnerability affects the mlx5e network driver in the Linux kernel (used by Mellanox/NVIDIA ConnectX NICs). The root cause is that mlx5e_activate_txqsq() unconditionally calls netdev_tx_reset_queue(), which zeroes BQL (Byte Queue Limits) counters on channels that still have in-flight TX WQEs...

CVE-2026-74698 net/mlx5e: fix BQL reset on SQ re-activation

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix BQL reset on SQ re-activation mlx5equeuestart deactivates and re-activates all channels but closes only the queue being restarted. mlx5eactivatetxqsq then unconditionally calls netdevtxresetqueue, zeroing the BQL...

EUVD-2026-64385

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix BQL reset on SQ re-activation mlx5equeuestart deactivates and re-activates all channels but closes only the queue being restarted. mlx5eactivatetxqsq then unconditionally calls netdevtxresetqueue, zeroing the BQL...

CVE-2026-74677

CVE-2026-74677 is a use-after-free in the Linux kernel's ipheth USB network driver. The root cause is that ipheth_sndbulk_callback() re-arms the carrier_work delayed work on any non-zero URB status without checking whether the interface is still up. After ipheth_close() drains the work, a late UR...

EUVD-2026-64364

In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrierwork UAF on disconnect iphethsndbulkcallback re-arms the carrier-check work on any non-zero URB status: else scheduledelayedwork&dev-carrierwork, 0; Nothing ties that to the interface being up, so the...

CVE-2026-74677 net: usb: ipheth: fix carrier_work UAF on disconnect

In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrierwork UAF on disconnect iphethsndbulkcallback re-arms the carrier-check work on any non-zero URB status: else scheduledelayedwork&dev-carrierwork, 0; Nothing ties that to the interface being up, so the...

CVE-2026-74671 ima: fix out-of-bounds read in xattr_verify()

In the Linux kernel, the following vulnerability has been resolved: ima: fix out-of-bounds read in xattrverify The digest-length check in xattrverify mixes int and sizet: if xattrlen - sizeofxattrvalue-type - hashstart = iint-imahash-length sizeof yields sizet, so the usual arithmetic conversions...

CVE-2026-74671

CVE-2026-74671 is an out-of-bounds read in the Linux kernel's IMA (Integrity Measurement Architecture) subsystem, specifically in the xattr_verify() function. The root cause is a type mismatch between int and size_t in the digest-length check: sizeof() promotes the entire left-hand expression to ...

EUVD-2026-64358

In the Linux kernel, the following vulnerability has been resolved: ima: fix out-of-bounds read in xattrverify The digest-length check in xattrverify mixes int and sizet: if xattrlen - sizeofxattrvalue-type - hashstart = iint-imahash-length sizeof yields sizet, so the usual arithmetic conversions...

CVE-2026-74658

CVE-2026-74658 is a race condition in the Linux kernel robust futex exit handling. When a woken waiter is killed before it can acquire the futex or re-arm FUTEX_WAITERS , and a third task re-acquires the futex via the uncontended fast path, the notification is lost. The new owner sees no FUTEX_WA...