CVE-2026-74395

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5IBMETHODDEVXSUBSCRIBEEVENT links eventsub into sublist before initializing the fields used by the shared error path. If eventfdctxfdget then fails, the unwind path...

CVE-2026-74394

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check immbuf-len is a user-controlled uint32t received from the network. Adding it to immdataoffset without overflow checking allows a malicious initiator to send...

CVE-2026-74396

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure mlx5rumrupdatexlt allocates and DMA maps an XLT buffer with mlx5rumrcreatexlt. The buffer is released by the common cleanup path through mlx5rumrunmapfreexlt. After...

CVE-2026-74397

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5iballoctransportdomain allocates a transport domain and then may fail in mlx5ibenablelb. In that case, the allocated TD is leaked. Fix this by deallocatin...

CVE-2026-74389

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix log flood after cmdmbox failure hnsrocecmdmbox is the command interface between driver and hardware. When hardware is abnormal, the unlimited error printings after hnsrocecmdmbox failure will cause log flood and eve...

CVE-2026-74384

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible array member, currentpath, which is indexed using the NUMA node ID: head-currentpathnumanodeid The structure is currently allocated as...

CVE-2026-74382

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: prevent unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in clsbpfoffloadcmd. Reproducer on netdevsim: add a skipsw clsbpf filter, set the bpftcaccept debugfs knob to 0, then tc filt...

CVE-2026-74386

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmettcpallocqueue, when a connection is closed during the allocation process e.g., nvmettcpsetqueuesock returns -ENOTCONN, the error handling jumps to outdestroysq and the...

CVE-2026-74385

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check return value of nvmettcpsetqueuesock The return value of nvmettcpsetqueuesock is currently ignored in nvmettcptlshandshakedone. If it fails e.g., due to the socket not being in TCPESTABLISHED state, the socket...

CVE-2026-74387

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...

CVE-2026-74383

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvmesetupdescriptorpools nvmesetupdescriptorpools indexes dev-descriptorpools using the numanode forwarded from hctx-numanode by its single caller, nvmeinithctxcommon. On a non-NUMA kernel...

CVE-2026-74388

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data The OSS sequencer processes the input MIDI bytes into a sequencer event to be dispatched later in sndseqossmidiputc called from sndseqossprocessevent. When it's ...

CVE-2026-74390

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix out-of-bounds write in irdmacopyuserpgaddrs The irdmacopyuserpgaddrs function loops through all of the umem DMA blocks to populate the PBLEs and will stop when either the last DMA block is reached or palloc-totalc...

CVE-2026-74381

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1xbopin with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference to...

CVE-2026-74374

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix error-path detection with mdclonedbio Detect the error path using mdclonedbio instead of relying on r1bio in raid1 or r10bio-readslot in raid10, which may be NULL or -1 after splitting and resubmitting a fail...

CVE-2026-74377

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like numsge or...

CVE-2026-74379

In the Linux kernel, the following vulnerability has been resolved: dax/kmem: account for partial discontiguous resource upon removal When devdaxkmemprobe partially succeeds at least one range is mapped but a subsequent range fails requestmemregion or addmemorydrivermanaged, the probe silently...

CVE-2026-74373

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix bio accounting for split md cloned bios Use mdclonedbio to control bio accounting instead of relying on r1bioexisted in raid1 or the ioaccounting flag in raid10. The previous logic does not reliably reflect...

CVE-2026-74375

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix deadlock in read error recovery path raid1d and raid10d may resubmit a split md cloned bio while handling a read error. In this case, resubmitting the bio can lead to a deadlock if the array is suspended befo...

CVE-2026-74378

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in getsrqwqe getsrqwqe reads wqe-dma.numsge from the shared receive queue buffer, which is mapped into userspace. It validates numsge against maxsge, but then re-reads the same field to calculat...

CVE-2026-74376

In the Linux kernel, the following vulnerability has been resolved: md/raid10: reset readslot when reusing r10bio for discard putallbios always drops devsi.bio, but it only drops devsi.replbio when r10bio-readslot 0. If discard reuses an r10bio that was previously used for a read, readslot can...

CVE-2026-74380

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommumapsgtable return value check Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a zero. pinj...

CVE-2026-74370

In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix TOCTOU race in luosessionretrieve Extend the scope of the rwsemread lock in luosessionretrieve to overlap with the acquisition of the session mutex. This prevents a concurrent thread from releasing and freeing the...

CVE-2026-74372

In the Linux kernel, the following vulnerability has been resolved: raid1: fix nrpending leak in REQATOMIC bad-block error path In raid1writerequest, each per-mirror loop iteration begins by incrementing rdev-nrpending. If a REQATOMIC write encounters a badblock within the requested range, the co...

CVE-2026-74368

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12kwifi7dprxhverifytkipmic In ath12kwifi7dprxhverifytkipmic, the call to ath12kdprxchecknwifihdrlenvalid may return false when the NWIFI header length is invalid, causing the function to abort...

CVE-2026-74364

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps as inner maps in map-in-map An exclusive map created with exclproghash is bound to a single program by hash: checkmapprogcompatibility refuses to load any program whose digest does not match...

CVE-2026-74367

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix inconsistent arvif state in vdevcreate error paths ath12kmacvdevcreate has three error path issues that leave arvif in an inconsistent state: 1. When ath12kwmivdevcreate fails, the function returns directly...

CVE-2026-74366

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in changestalinks for unready link ieee80211setactivelinks calls ieee80211linkusechannel for each newly-added link and WARNONONCEs if it fails. The call uses assignonfailure=true, which allows mac8021...

CVE-2026-74365

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

CVE-2026-74369

In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix u-a-f in luofileunpreservefiles and luofilefinish In luofileunpreservefiles and luofilefinish, reorder moduleput and xaerase to ensure the file handler module remains pinned while its operations are being accessed...

CVE-2026-74371

In the Linux kernel, the following vulnerability has been resolved: bpf: fix BPFPROGQUERY OOB write and cgroup backward compat BPFPROGQUERY writes back the 'query.revision' field unconditionally to userspace. If userspace passes a smaller 'bpfattr' structure e.g. 40 bytes, which was the layout...

CVE-2026-74359

In the Linux kernel, the following vulnerability has been resolved: configfslookup: don't leave -sdentry dangling on failure Normally -sdentry is cleared when dentry it's pointing to becomes negative on eviction, realistically. However, that only happens if dentry gets to be positive in the first...

CVE-2026-74362

In the Linux kernel, the following vulnerability has been resolved: ext2: fix ignored return value of genericwritesync Fix ext2diowriteiter to propagate the error returned by genericwritesync instead of silently discarding it, which could cause write2 to return success to userspace on OSYNC/ODSYN...

CVE-2026-74363

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 "bpf: Avoid RCU context warning when unpinning htab with internal structs" moved inode cleanup from -freeinode into -destroyinode to avoid sleeping ...

CVE-2026-74361

In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used instead of =, incorrectly accepting fdpidx when it equals n i.e. NUMFDPC + 1...

CVE-2026-74356

In the Linux kernel, the following vulnerability has been resolved: vhost: fix vhostgetavailidx for a non empty ring vhostgetavailidx is supposed to report whether it has updated vq-availidx. Instead, it returns whether all entries have been consumed, which is usually the same. But not always - i...

CVE-2026-74358

In the Linux kernel, the following vulnerability has been resolved: ext4: fix fast commit wait/wake bit mapping on 64-bit On 64-bit, ext4 dynamic inode states live in the upper half of iflags, and ext4testinodestate applies the corresponding +32 offset. The fast-commit wait and wake paths...

CVE-2026-74357

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpucoredump ring dump The ring content dump in amdgpucoredump uses two separate loops over adev-rings: the first counts rings with unsignalled fences to size the allocation, and the...

CVE-2026-74360

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps for bpfmapelem iterators Exclusive maps aka exclproghash are meant to be reachable only from the single program whose hash matches. This is enforced by checkmapprogcompatibility when the map is referenc...

CVE-2026-74354

In the Linux kernel, the following vulnerability has been resolved: bpf: Take mmaplock in zappages zapvmarange requires the owning mm's mmaplock to be held. Taking mmapreadlock under arena-lock would AB-BA against arenavmclose and arenamapmmap, both of which run with mmapwritelock held and then...

CVE-2026-74352

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: avoid post-init UAF when allocreservedmemarray fails The global pointer 'reservedmem' continues to reference the reservedmemarray which lives in initdata if allocreservedmemarray fails. ofreservedmemlookup is...

CVE-2026-74351

In the Linux kernel, the following vulnerability has been resolved: ocfs2: rebase copied fsdlm LVB pointers in lockingstate The lockingstate debugfs iterator snapshots struct ocfs2lockres by value under ocfs2dlmtrackinglock and later formats that copy in ocfs2dlmseqshow. That is fine for the inli...

CVE-2026-74353

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: always resumeall after suspendall Need to restore any good queues even if the suspendall failed for some. Always run removequeue as that will schedule a GPU reset is removing the queue fails. v2: move resumeall after...

CVE-2026-74349

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject FITRIM ranges shorter than a cluster ocfs2trimmainbm trims the global bitmap in cluster units, but its too-short range validation only checks sb-sblocksize. On filesystems with a cluster size larger than the block...

CVE-2026-74350

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate fast symlink target during inode read ocfs2validateinodeblock already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same treatmen...

CVE-2026-74355

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix RB-tree corruption in probe error path The info-node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the devicerbtreeinsert call is skipped. If a subsequent probe step fails, the...

CVE-2026-74348

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: require a ref for lockingstate debugfs open debuglockresopen copies inode-iprivate into struct debuglockres and debuglockresrelease later drops that pointer with dlmput. That only works if open successfully pins the...

CVE-2026-74341

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix heap overflow from oversized firmware HAL response The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte halbuf without validating the response length. A response exceeding...

CVE-2026-74345

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix endpoint/socket association handling Disassociating a socket from an endpoint via siwsocketdisassoc may release the last reference on that endpoint and free it. Therefore, don't clear the endpoints socket pointer...

CVE-2026-74346

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev//patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating...