CVE-2026-74510

CVE-2026-74510 affects the Linux kernel Bluetooth mgmt subsystem. It describes a use-after-free (UAF) in pair command cancellation: pairing completion and authentication failure callbacks could dereference a command freed due to races on the shared mgmt_pending list. The root cause is a lookup th...

CVE-2026-74508

CVE-2026-74508 affects the Linux kernel Bluetooth HIDP path. The bug occurs in hidp_recv_ctrl_frame() and hidp_recv_intr_frame(): they read skb->data[0] before verifying the L2CAP SDU header, enabling an uninitialized-byte use from skb tailroom when an empty basic-mode SDU is received or when ...

CVE-2026-74509

The CVE applies to the Linux kernel Bluetooth HCI path for extended advertising. Root cause: hci_find_adv_instance() can return an adv_info pointer that remains valid only while hdev->lock is held, but advertisement data paths perform lookups without that lock and may retain the pointer while ...

CVE-2026-74506

Summary: CVE-2026-74506 affects the Linux kernel AFS code path, where a race in afs_make_call() between async dispatch and destruction could lead to a use-after-free (UAF) of the afs_call, potentially triggering a crash when handling FS.StoreData data. The root cause described across multiple sou...

CVE-2026-74507

The CVE-2026-74507 vulnerability affects the Linux kernel Bluetooth HIDP implementation. The issue occurs in hidp_get_raw_report()/hidp_process_data() when validating numbered HID reports: a peer can reply with a DATA header and cause the code to read beyond the payload, potentially reading a pee...

CVE-2026-74505

CVE-2026-74505 affects the Linux kernel ALSA: 6fire driver. Root cause: a use-after-free can occur if a pending URB is not freed during early error handling in probe. Fix: the patch adds cleanup at the error path similar to the normal disconnect procedure. Impact and remediation are limited to th...

CVE-2026-74503

In the provided CVE-2026-74503 entries, the Linux kernel ALSA timer issue is resolved: snd_timer_close_locked() marks an instance with SNDRV_TIMER_IFLG_DEAD and a close can leave an object referenced if reopened mid‑process. The vulnerability concerns ALSA timer handling when closing snd_timer in...

CVE-2026-74504

Summary (CVE-2026-74504): The Linux kernel ALSA sequencing timer (SND_UTIMER) can be driven by an unprivileged user to set arbitrary 64‑bit hardware resolution for snd_timer via SNDRV_TIMER_IOCTL_CREATE. When bound to a sequencer queue, initialize_timer() computes tmr->ticks = 1_000_000_000 / ...

CVE-2026-74502

The CVE-2026-74502 issue affects the Linux kernel ALSA subsystem (ump) where snd_ump_attach_legacy_rawmidi() allocates ump->out_cvts and frees it on error via kfree(), leaving a stale pointer. If the endpoint is torn down later, snd_ump_endpoint_free() frees ump->out_cvts a second time, cau...

CVE-2026-74501

CVE-2026-74501 affects the Linux kernel ALSA usb-audio, where create_midi2_ump() stores a back-pointer to a per-interface object in ump->private_data but never clears it or installs a private_free hook. If snd_usb_midi_v2_create() fails, free_all_midi2_umps() frees the object while an already-...

CVE-2026-74500

CVE-2026-74500 affects the Linux kernel’s ALSA usb-audio for RME Digiface. The issue arises when snd_rme_digiface_read_status() reads a four-word status block into an uninitialised on‑stack buffer and, if the vendor IN transfer isn’t negative, copies all four words to status[]. Additionally, snd_...

CVE-2026-74499

CVE-2026-74499 – Linux kernel ALSA USB-audio OOB write . Concrete details across connected docs show an issue in snd_usbmidi_akai_output() where buf_end is computed as a signed int (ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1). A tiny bulk-OUT endpoint can make buf_end negative, and the subseque...

CVE-2026-74498

CVE-2026-74498 affects the Linux kernel ALSA USB-audio driver. The vulnerability arises from DMA buffer sizing for full-packet transfers: when fill_max is set, data_ep_set_params() promotes ep->curpacksize to ep->maxpacksize, but maxsize remains the original value derived from the sample ra...

CVE-2026-74497

CVE-2026-74497 pertains to the Linux kernel, affecting ALSA usb-audio by clamping the frame size in implicit-feedback mode. The root cause is in snd_usb_handle_sync_urb(), which scales sync packet sizes and stores them directly in out_packet->packet_size[i]. If a connected USB device sends an ...

CVE-2026-74495

CVE-2026-74495 affects the Linux kernel igbvf driver. The issue is a leak in TX DMA error cleanup: when mapping TX buffers, buffers already mapped for a skb must be unmapped. The root cause is an off-by-one error from decrementing the count before the dma_error loop, after the count had been incr...

CVE-2026-74496

Linux kernel vulnerability CVE-2026-74496 affects the Fou (FOU) path. fou_create() publishes the fou struct via sk_user_data before the new FOU port is added to the per-netns list; if fou_add_to_port_list() fails, fou is freed while still reachable through sk_user_data, allowing a concurrent rece...

CVE-2026-74494

CVE-2026-74494 relates to ksmbd in the Linux kernel. Unauthenticated clients can issue multiple SMB2 NEGOTIATE requests on a single connection before SESSION_SETUP; during KSMBD_SESS_NEED_SETUP, smb2_handle_negotiate() may accept another SMB3.1.1 NEGOTIATE and overwrite conn->preauth_info, cau...

CVE-2026-74492

The CVE-2026-74492 entry concerns the Linux kernel netfilter ipset subsystem. Technical description across official and vendor advisories shows that during resize operations, mtype_resize() copies only comment pointers, while the old table is published for packet-side updates before the replaceme...

CVE-2026-74493

CVE-2026-74493 affects the Linux kernel net/smc subsystem. The issue is a use-after-free during link group termination in __smc_lgr_terminate: conns_lock is dropped after locating a connection but before taking a reference on its socket. Since the socket is embedded in the connection and the regi...

CVE-2026-74490

CVE-2026-74490 affects the Linux kernel’s TIPC subsystem. According to multiple sources (NVD, SUSE, Debian, OSV, PT Security, EUVD), the issue is a use-after-free in the poll trace path where tipc_poll() can trigger queue dumps (tipc_list_dump) while an skb may be dequeued and freed in an unlocke...