CVE-2026-74263

The CVE affects the Linux kernel net: wwan: t7xx driver. In t7xx_port_ctrl_tx, each skb fragment is cloned and the clone is immediately used to set cloned->len; if skb_clone() fails, a NULL pointer dereference can occur. The fix checks the clone before using it and, when previous fragments are...

CVE-2026-74262

In the Linux kernel, CVE-2026-74262 affects the kernel networking path used by KCM. kcm_attach() replaces a live lower TCP socket’s sk_data_ready and sk_write_space callbacks with KCM handlers, and kcm_unattach() restores them later. These updates were plain stores and could be observed by other ...

CVE-2026-74261

CVE-2026-74261 — In the Linux kernel ALSA sequencer, a bug during fifo pool resize could leave stale cells and block pool teardown. The issue stems from snd_seq_fifo_resize() waiting for the replacement pool while a reader holds f->use_lock, and race conditions where events can be duplicated o...

CVE-2026-74260

In the Linux kernel, CVE-2026-74260 concerns netfilter nf_dup_netdev. Affected area: nf_dev_xmit_recursion*() helpers were added and then used by nft_dup and nft_fwd. The patch also disables bh (BH) when transmitting the skb to address potential migration to a different CPU, which could cause imb...

CVE-2026-74259

Summary (mode C): CVE-2026-74259 affects the Linux kernel CIFS implementation. The issue arises when cifs files are not cleaned up before killing the superblock during unmount, allowing a NULL pointer dereference in cifsFileInfo_put_final which can trigger a BUG check. Reproduction notes outline ...

CVE-2026-74258

Summary (CVE-2026-74258): The Linux kernel patch fixes a vulnerability in the BPF upprobe path where __get_user could read user-space data without proper bounds checks. The root cause is missing bounds validation prior to using __get_user in uprobe_multi data; the fix adds an access_ok check to v...

CVE-2026-74257

CVE-2026-74257 stems from a use-after-free in the Linux kernel sockmap path (udp_bpf_recvmsg) where sk_msg_recvmsg() can touch the same sk_msg when multiple threads race. The mitigation described in connected docs is to serialize sk_msg_recvmsg() by callers, specifically by adding a lock around u...

CVE-2026-74256

The CVE-2026-74256 family affects the Linux kernel’s BPF sockmap path, where bpf_msg_pop_data() bounds checks used 32-bit arithmetic on start/len. An unsigned-to-signed overflow could allow an out-of-range start/len, causing the pop loop to walk past scatterlist end and trigger put_page on an emp...

CVE-2026-74255

The CVE affects the Linux kernel’s TIPC path, detailing a use-after-free in ipvlan_hard_header() invoked from tipc_l2_send_msg(). The root cause is tipc_disable_l2_media() calling synchronize_net() while b->media_ptr is still valid, allowing concurrent RCU readers to obtain a freed device poin...

CVE-2026-72502

The CVE-2026-72502 issue affects the Linux kernel TCP/IPv6 path: when MTU is large, ip6_default_advmss() could return IPV6_MAXPLEN (65535), which TCP could treat as mss_clamp, allowing an MSS of 65535. The bug also coalesces with GSO_BY_FRAGS (0xFFFF), causing a NULL pointer dereference if a TCP ...

CVE-2026-72500

The CVE-2026-72500 vulnerability in the Linux kernel affects RDMA/bnxt_re and related code paths (bnxt_qplib_destroy_srq) where a toggle page is freed before firmware teardown completes. The root cause is freeing the page too early, allowing an NQ interrupt arriving during bnxt_qplib_destroy_srq(...

CVE-2026-72501

The CVE-2026-72501 entry concerns the Linux kernel’s RDMA/bnxt_re code path. The bug was that the dpi variable was initialized only for BNXT_RE_ALLOC_WC_PAGE and then copied in other cases, potentially leaving an uninitialized dpi. The fix initializes dpi to 0 across all paths, resolving the issu...

CVE-2026-72499

The CVE-2026-72499 issue is in the Linux kernel RDMA bnxt_re path. The vulnerability is resolved by changing the teardown order: free_page() is moved to occur after bnxt_qplib_destroy_cq(), so an NQ interrupt arriving during CQ destruction won’t write to an already-freed toggle page. Affected com...

CVE-2026-72498

The CVE-2026-72498 entry affects the Linux kernel's RDMA driver bnxt_re. The issue concerns the dumping of MR info with the rdma tool, where the mr_hwq (a kernel pointer) was exposed to end users. The vulnerability was resolved by avoiding display of the kernel pointer when dumping MR information...

CVE-2026-72497

CVE-2026-72497 concerns the Linux kernel RDMA/bnxt_re path. The description states a fix was implemented to validate the WQE mode against the hardware-supported maximum slots (64K), adding both a max and min check and failing if the user-supplied value exceeds the max or is zero. The vulnerabilit...

CVE-2026-72496

CVE-2026-72496 affects the Linux kernel RDMA/bnxt_re path. The root cause is in bnxt_qplib_alloc_dpi returning success when ioremap fails; the fix adds proper rollback on ioremap failure and returns -ENOMEM. The published metrics indicate a CRITICAL base score (CVSS 3.1: AV:L/AC:L/PR:N/UI:N/S:C/C...

CVE-2026-72495

CVE-2026-72495 affects the Linux kernel’s RDMA/bnxt_re path. The vulnerability arises from allowing multiple WC pages for the same ucontext; only 1 WC page per ucontext is supported. The fix adds a lock to prevent concurrent access and a check to fail repeated requests. Additionally, if the mmap ...

CVE-2026-72494

CVE-2026-72494 : In the Linux kernel RDMA/irdma driver, a synchronization issue was resolved by replacing a waitqueue plus request_done flag (lacked proper memory barriers) with a completion primitive designed for this purpose. The change removes the explicit flag and barriers, relying on the com...

CVE-2026-72493

CVE-2026-72493 concerns a race condition in the Linux kernel where a lockless netif_running() check in enqueue_to_backlog() allowed a TOCTOU window during device backlog flushing on unregistration (e.g., netns exit). The issue can let packets escape backlog processing and trigger a use‑after‑free...

CVE-2026-72492

The CVE-2026-72492 issue concerns ksmbd (Linux kernel) where same_client_has_lease() returns an opinfo pointer from ci->m_op_list after dropping ci->m_lock without holding a reference. smb_grant_oplock() later dereferences this pointer in copy_lease() and while checking breaking_cnt, riskin...