CVE-2026-74546

In the Linux kernel, the following vulnerability has been resolved: hwmon: adt7470 Fix divide-by-zero TOCTOU crash in fan speed read If the fan data becomes 0 between the FANDATAVALID check and the FANPERIODTORPM conversion, it will result in a divide-by-zero crash due to a race with a concurrent...

CVE-2026-74443

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmwcmddma locates the DMA suffix at unsigned long &cmd-body + header-size - sizeofsuffix without checking that header-size is large enough to contain both cmd-body an...

CVE-2026-74490

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid use-after-free in poll trace queue dumps TIPC socket tracepoints dump queue state through tipcskdump. Most queue-dump callsites already serialize that walk under the socket lock or sk-sklock.slock, but tipcpoll calls...

CVE-2026-74482

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: unlock immaprwsem before releasing after-split folios foliosplit keeps dereferencing the mapping after the split: shmemunchargemapping-host and remappage while the folios are still frozen/locked, and...

CVE-2026-74460

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the...

CVE-2026-74471

In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of registerevent in tracemoduleaddevents tracemoduleaddevents ignores the return value of registerevent and unconditionally calls addeventtotracers for each event. If registerevent fails for example, i...

CVE-2026-74465

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix potential UAF on meter attach failure While attaching a newly created meter attachmeter function makes the new meter visible to other CPUs but can still fail afterwards. On failure, it detaches the meter bac...

CVE-2026-74459

In the Linux kernel, the following vulnerability has been resolved: can: etases58x: es58xreadbulkcallback: fix RX buffer leak on URB resubmit failure es58xreadbulkcallback resubmits the RX URB after processing a received packet. If the resubmit succeeds, the URB remains anchored and will be handl...

CVE-2026-73632

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-73635

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches...

CVE-2026-73631

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intende...

CVE-2026-73634

Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service...

CVE-2026-74365

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

CVE-2026-74354

In the Linux kernel, the following vulnerability has been resolved: bpf: Take mmaplock in zappages zapvmarange requires the owning mm's mmaplock to be held. Taking mmapreadlock under arena-lock would AB-BA against arenavmclose and arenamapmmap, both of which run with mmapwritelock held and then...

CVE-2026-72313

In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: Only consider active CRTCs for vblank sync Only synchronize fbdev output to the vblank of an active CRTC. Go over the list of CRTCs and pick the first that matches. Fixes warnings as the one shown below 77.201354...

CVE-2026-72406

In the Linux kernel, the following vulnerability has been resolved: net: sungem: fix probe error cleanup geminitone calls gemremoveone when registernetdev fails. gemremoveone unregisters and frees resources owned by the netdevice, including the DMA block, MMIO mapping, PCI regions, and the...

CVE-2026-74389

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix log flood after cmdmbox failure hnsrocecmdmbox is the command interface between driver and hardware. When hardware is abnormal, the unlimited error printings after hnsrocecmdmbox failure will cause log flood and eve...

CVE-2026-74341

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix heap overflow from oversized firmware HAL response The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte halbuf without validating the response length. A response exceeding...

CVE-2026-74388

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data The OSS sequencer processes the input MIDI bytes into a sequencer event to be dispatched later in sndseqossmidiputc called from sndseqossprocessevent. When it's ...

CVE-2026-74385

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check return value of nvmettcpsetqueuesock The return value of nvmettcpsetqueuesock is currently ignored in nvmettcptlshandshakedone. If it fails e.g., due to the socket not being in TCPESTABLISHED state, the socket...

CVE-2026-74362

In the Linux kernel, the following vulnerability has been resolved: ext2: fix ignored return value of genericwritesync Fix ext2diowriteiter to propagate the error returned by genericwritesync instead of silently discarding it, which could cause write2 to return success to userspace on OSYNC/ODSYN...

CVE-2026-74349

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject FITRIM ranges shorter than a cluster ocfs2trimmainbm trims the global bitmap in cluster units, but its too-short range validation only checks sb-sblocksize. On filesystems with a cluster size larger than the block...

CVE-2026-74340

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count in PRINTREGINFO indication The firmware-controlled rsp-count field is used as the loop bound for indexing into the flexible rsp-regs array without validation against the message...

CVE-2026-74392

In the Linux kernel, the following vulnerability has been resolved: dm: limit target bio polling to one shot dmpollbio is the -pollbio callback for a stacked dm device. The caller only knows about the dm queue, so it may decide to do a spinning poll if it thinks a single queue is being polled...

CVE-2026-74422

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: inno-hdmi: Switch to drmmkzalloc Driver makes use of drmmencoderinit to initialize the encoder and automatically handle the cleanup by registering drmencodercleanup with drmmaddaction. However, the internal structur...

CVE-2026-74383

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvmesetupdescriptorpools nvmesetupdescriptorpools indexes dev-descriptorpools using the numanode forwarded from hctx-numanode by its single caller, nvmeinithctxcommon. On a non-NUMA kernel...

CVE-2026-74427

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls a...

CVE-2026-74351

In the Linux kernel, the following vulnerability has been resolved: ocfs2: rebase copied fsdlm LVB pointers in lockingstate The lockingstate debugfs iterator snapshots struct ocfs2lockres by value under ocfs2dlmtrackinglock and later formats that copy in ocfs2dlmseqshow. That is fine for the inli...

CVE-2026-74403

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Check for page allocation failure correctly in TIO Sashiko notes: if snpallocfirmwarepages returns NULL under memory pressure, is it safe to pass it directly to pageaddress? On architectures without HASHEDPAGEVIRTUA...

CVE-2026-74374

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix error-path detection with mdclonedbio Detect the error path using mdclonedbio instead of relying on r1bio in raid1 or r10bio-readslot in raid10, which may be NULL or -1 after splitting and resubmitting a fail...

CVE-2026-74419

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Adjust size for copytouser The amount of data returned to user space should be limited by the buffer size provided by the application. If the buffer is smaller than the data size, return only the portion that fits...

CVE-2026-74424

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vcdata fbconnewmodelist runs when a framebuffer's modelist changes. For each console mapped to it with fbdisplayi.mode set, it reads vcconsi.d and passes the vcnum to...

CVE-2026-74396

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure mlx5rumrupdatexlt allocates and DMA maps an XLT buffer with mlx5rumrcreatexlt. The buffer is released by the common cleanup path through mlx5rumrunmapfreexlt. After...

CVE-2026-74430

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...

CVE-2026-74405

In the Linux kernel, the following vulnerability has been resolved: OPP: Fix race between OPP addition and lookup A race exists between devpmoppadddynamic and devpmoppfindfreqexact: CPU0 add CPU1 lookup ------------------------------- ------------------------------ oppadd mutexlock...

CVE-2026-74390

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix out-of-bounds write in irdmacopyuserpgaddrs The irdmacopyuserpgaddrs function loops through all of the umem DMA blocks to populate the PBLEs and will stop when either the last DMA block is reached or palloc-totalc...

CVE-2026-74421

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dwdp: Switch to drmmkzalloc Driver makes use of drmmencoderinit to initialize the encoder and automatically handle the cleanup by registering drmencodercleanup with drmmaddaction. However, the internal structure...

CVE-2026-74407

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery SSR. The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed...

CVE-2026-74391

In the Linux kernel, the following vulnerability has been resolved: tracing: Bound synthetic-field strings with seqbuf The synthetic field helpers build a prefixed synthetic variable name and a generated hist command in fixed MAXFILTERSTRVAL buffers. The current code appends those strings with ra...

CVE-2026-74302

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix UAF in hciunregisterdev hciunregisterdev does not disable cmdtimer and ncmdtimer before the hcidev structure is freed. If a timeout fires during device teardown, the callback dereferences freed memory...

CVE-2026-72375

In the Linux kernel, the following vulnerability has been resolved: afs: Fix reinitialisation of the inode, in particular -lockwork It seems that initalising afsvnode::lockwork a single time in the slab's init function isn't sufficient for workstructs. This results in the DEBUGOBJECTS debugging...

CVE-2026-74305

In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 "bpf: Fix oob access in cgroup local storage" is still incomplete. The prog-array compatibility check treats a program with no cgroup storag...

CVE-2026-74277

In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommudmamapsg, when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment s is incorrectly assigned from the head entry sg-length...

CVE-2026-74284

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: Don't make class passive twice updatevf is called from two places for the same class during a single dequeue when the class's child qdisc e.g. codel/fqcodel drops its last packets while dequeuing: 1. The child...

CVE-2026-74282

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent sntunacked underflow on CONNACK tipcskconnprotorcv subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter sntunacked without checking that it does not exceed the number of messages...

CVE-2026-72444

In the Linux kernel, the following vulnerability has been resolved: flowdissector: check device type before reading ETHADDRS skbflowdissect unconditionally reads 12 bytes from ethhdrskb when FLOWDISSECTORKEYETHADDRS is requested. This assumes the skb has a valid Ethernet header at macheader, whic...

CVE-2026-72372

In the Linux kernel, the following vulnerability has been resolved: afs: Fix lack of locking around modifications of net-cellsdynino Fix the lack of locking around modifications of net-cellsdynino by taking net-cellslock exclusively. This also requires to cell to be removed from net-cellsdynino i...

CVE-2026-74286

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

CVE-2026-72480

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling amseventtochannel may return a pointer past the end of dev-channels when no matching scanindex is found. This can lead to invalid memory access in...

CVE-2026-74313

In the Linux kernel, the following vulnerability has been resolved: vduse: hold vduselock across IDR lookup in open path vdusedevopen looks up struct vdusedev through the IDR and then acquires dev-lock only after vduselock has been dropped. This leaves a window where a concurrent VDUSEDESTROYDEV...