CVE-2026-74300

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes...

CVE-2026-72449

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadata without removing it from the list. The list head is left pointing a...

CVE-2026-72454

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3chciaddrtodev i3chciaddrtodev walks bus-devs.i3c, which is protected by bus.lock rwsem. However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows concurrent...

CVE-2026-72314

In the Linux kernel, the following vulnerability has been resolved: regulator: core: regulatorlocktwo should test for EDEADLK not EDEADLOCK Compare against -EDEADLK, which is what wwmutexlock actually returns and what every other deadlock check in this file already uses. Function regulatorlocktwo...

CVE-2026-72408

In the Linux kernel, the following vulnerability has been resolved: geneve: gate GRO hint in genevegrocomplete on gs-grohint genevegroreceive reads the GRO hint through geneveskgrohintoff, which honours it only when the socket enabled IFLAGENEVEGROHINT gs-grohint. genevegrocomplete instead calls...

CVE-2026-72371

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFSVOLUMERMTREE is set on Fix afsinsertvolumeintocell to set AFSVOLUMERMTREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volume to be...

CVE-2026-72321

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential memory leaks in igmpmodtimer and igmpstoptimer When a timer is deleted and not re-armed in igmpmodtimer, or stopped in igmpstoptimer, the code currently decrements the reference counter of the multicast...

CVE-2026-74420

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Reject VMAs with VMIO or VMPFNMAP when creating SVM ranges VMAs marked with VMIO or VMPFNMAP are not backed by struct page objects, which GPUSVM requires in order to operate correctly. In particular, getpages relies o...

CVE-2026-74382

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: prevent unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in clsbpfoffloadcmd. Reproducer on netdevsim: add a skipsw clsbpf filter, set the bpftcaccept debugfs knob to 0, then tc filt...

CVE-2026-74409

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware macid in link lookup The macid field in RX descriptors is 8 bits wide 0-255, but assoclinkonmacid has only RTW89MAXMACIDNUM 128 entries. While the driver currently assigns macid values...

CVE-2026-74408

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...

CVE-2026-74368

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12kwifi7dprxhverifytkipmic In ath12kwifi7dprxhverifytkipmic, the call to ath12kdprxchecknwifihdrlenvalid may return false when the NWIFI header length is invalid, causing the function to abort...

CVE-2026-74296

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Free the UAR index returned by the hardware...

CVE-2026-74280

In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sgcleanup path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

CVE-2026-72489

In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvecrxcompleted In nvecrxcompleted, when an incomplete RX transfer is detected, nvecmsgfree is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately aft...

CVE-2026-74334

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Fix locking when accessing mr-pd Sashiko points out that, due to reregmr, the PD is actually variable and all the touches in nldev are racy. Use mr-device instead of mr-pd-device. Getting the PD restrack ID is more...

CVE-2026-72491

In the Linux kernel, the following vulnerability has been resolved: net/9p: fix race condition on rdma-state in transrdma.c The rdma-state field is modified without holding reqlock in both recvdone and p9cmeventhandler, while rdmarequest accesses the same field under the reqlock spinlock. This...

CVE-2026-72452

In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intelcrtcputcolorblobs drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intelcrtcprepareclearedstate, which fre...

CVE-2026-72357

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Use proper mmstruct in inuprobetrampoline In the unregister path we use inuprobetrampoline check with current-mm for the VMA lookup, which is wrong, because we are in the tracer context, not the traced process. Add...

CVE-2026-74309

In the Linux kernel, the following vulnerability has been resolved: vdpa/octeonep: fix IRQ-to-ring mapping in interrupt handler Look up the IRQ index in octhw-irqs instead of assuming irq - irqs0. This supports non-contiguous IRQ numbers and avoids incorrect ring indexing when irqs0 is not the ba...

CVE-2026-74330

In the Linux kernel, the following vulnerability has been resolved: configfs: fix lockless traversals of -schildren Having the parent directory locked protects entries from removal by another thread, but it does not protect cursors from being moved around by lseek - or freed, for that matter...

CVE-2026-74322

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996macwritetxwi80211 For injected frames e.g. via radiotap, mac80211 can pass info-control.vif = NULL, as explicitly noted in struct ieee80211txinfo. Check vif point...

CVE-2026-74308

In the Linux kernel, the following vulnerability has been resolved: ext4: fix kernel BUG in ext4writeinlinedataend When the data=journal mount option is used, the ext4journalledwriteend function incorrectly calls ext4writeinlinedataend without checking if the EXT4STATEMAYINLINEDATA flag is still...

CVE-2026-74288

In the Linux kernel, the following vulnerability has been resolved: net: fibrules: Don't dump dying fibrule in fibrulesdump. rockerrouterfibevent calls fibruleget during RCU dump. If the fibrule is dying, refcountinc will complain about it. Let's call refcountincnotzero in fibrulesdump...

CVE-2026-72461

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the skctx Currently updateskctx transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller conditionally put the referenc...

CVE-2026-72419

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnat: avoid invalid natnet pointer use on failed nfnatinit We ran into below KASAN splat, which is mostly uninteresting, beside for having nfnatregisterfn in the call chain as a cause for the offending access:...

CVE-2026-72324

In the Linux kernel, the following vulnerability has been resolved: gpio: mvebu: free generic chips on unbind irqallocdomaingenericchips allocates generic chip data that must be freed via irqdomainremovegenericchips. The devres action mvebugpioremoveirqdomain only called irqdomainremove, which on...

CVE-2026-72327

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3dgetcpuindirectcsdparams looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes...

CVE-2026-72336

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control getl2capconn looks up an LE hciconn under hdev protection, but then drops that protection before reading hcon-l2capdata and before lowpancontrolwrite later dereferences...

CVE-2026-74373

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix bio accounting for split md cloned bios Use mdclonedbio to control bio accounting instead of relying on r1bioexisted in raid1 or the ioaccounting flag in raid10. The previous logic does not reliably reflect...

CVE-2026-74294

In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: aiu: Validate written enum values The AIU HDMI and internal codec mux put callbacks use the written enum value with sndsocenumitemtoval before checking whether the value is valid for the enumeration. Reject...

CVE-2026-74278

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix kernel heap address leak in bounceerrorevent The comment above bounceerrorevent documents that user clients should receive SNDRVSEQEVENTBOUNCE with the original event embedded as variable-length data, while kernel...

CVE-2026-72470

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log-onepagebuf when adopting on-disk page size logreplay allocates log-onepagebuf using the page size that was chosen from the host PAGESIZE: log-onepagebuf = kmalloclog-pagesize, GFPNOFS; Later, when a restart...

CVE-2026-72338

In the Linux kernel, the following vulnerability has been resolved: net/sched: actpedit: fix TOCTOU heap OOB write in tc offload There is a TOCTOU race condition in flower lockless approach between sizing a flowrule buffer and filling it. [email protected] reports: The clsflower...

CVE-2026-72350

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtu32: reject invalid shift counts u32matchit executes rule-supplied shift operands on a 32-bit value. A malformed u32 rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during...

CVE-2026-74314

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpfobjfreefields when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete...

CVE-2026-74281

In the Linux kernel, the following vulnerability has been resolved: tipc: reject inverted service ranges from peer bindings tipcupdatenametbl inserts a binding advertised by a peer node using the lower and upper service-range bounds taken directly from the wire, without checking that lower upper ...

CVE-2026-72423

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an optssz argument. The verifier checks only the memory range described by optssz, but the wrappers...

CVE-2026-72300

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

CVE-2026-74438

In the Linux kernel, the following vulnerability has been resolved: crypto: sun4i-ss - Remove insecure and unused rngalg Remove sun4issrng, as it is insecure and unused: - It has multiple vulnerabilities. sun4issprngseed is missing locking and has a buffer overflow. sun4issprnggenerate fails to...

CVE-2026-74352

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: avoid post-init UAF when allocreservedmemarray fails The global pointer 'reservedmem' continues to reference the reservedmemarray which lives in initdata if allocreservedmemarray fails. ofreservedmemlookup is...

CVE-2026-74371

In the Linux kernel, the following vulnerability has been resolved: bpf: fix BPFPROGQUERY OOB write and cgroup backward compat BPFPROGQUERY writes back the 'query.revision' field unconditionally to userspace. If userspace passes a smaller 'bpfattr' structure e.g. 40 bytes, which was the layout...

CVE-2026-74412

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pcigetdrvdata type in AER handlers rtw88 stores an ieee80211hw pointer via pcisetdrvdata at probe time, but ioerrordetected and ioresume retrieve it as a netdevice pointer. This causes...

CVE-2026-74380

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommumapsgtable return value check Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a zero. pinj...

CVE-2026-72352

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: Fix hidbpfgetdata range check hidbpfgetdata returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside ctx-allocatedsize. The current check adds rdwrbufsize and offset before...

CVE-2026-72446

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: reject stream disable with no active interface handleuaudiostreamreq resolves an interface index with infoidxfromifnum, which returns -EINVAL when no interface matches. The enable branch and the response:...

CVE-2026-74257

In the Linux kernel, the following vulnerability has been resolved: sockmap: Fix use-after-free in udpbpfrecvmsg syzbot reported use-after-free of struct skmsg in skmsgrecvmsg. 0 skmsgrecvmsg peeks skmsg from psock-ingressmsg under a lock, but its processing is lockless. Thus, skmsgrecvmsg must b...

CVE-2026-72500

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free SRQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroysrq won't write the toggle values to an already-freed...

CVE-2026-74267

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcodel: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever codel drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog before i...

CVE-2026-74410

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer In rtwpcirxnapi, newlen is computed as the sum of pktlen 14-bit descriptor field, max 16383 and pktoffset drvinfosz + shift, both firmware-controlled. The...