CVE-2026-74374

CVE-2026-74374 affects the Linux kernel’s md/raid1 and md/raid10 code paths. The fix replaces error-path detection that relied on r1_bio or raid10’s read_slot with md_cloned_bio(), addressing cases where the error path is NULL or -1 after bio splitting/resubmission. The consequence previously cou...

CVE-2026-74372

CVE-2026-74372 concerns the Linux kernel RAID1 code path. In raid1_write_request(), every per-mirror iteration starts by incrementing rdev->nr_pending. If a REQ_ATOMIC write hits a badblock within the range, control jumps to err_handle without dropping the reference for the current mirror. The...

CVE-2026-74373

The CVE-2026-74373 entry documents a Linux kernel issue in md/raid1 and raid10 where bio accounting was incorrect for split md cloned bios. The mitigation implemented is to use md_cloned_bio() to detect md cloned bios and skip accounting accordingly, replacing reliance on r1bio_existed (raid1) or...

CVE-2026-74371

CVE-2026-74371 concerns a Linux kernel BPF issue where BPF_PROG_QUERY could cause an OOB write by unconditionally writing query.revision to userspace when a smaller bpf_attr buffer is provided. The fixes propagate the user-supplied attribute size (uattr_size) down to cgroup query handlers and ski...

CVE-2026-74370

The CVE-2026-74370 issue affects the Linux kernel and is resolved by a liveupdate fix for a TOCTOU race in luo_session_retrieve(). The root cause was a race between the lookup and the session mutex where a thread could release and free the session; the patch extends the scope of the rwsem_read lo...

CVE-2026-74369

The CVE-2026-74369 entries describe a Linux kernel vulnerability fix in the liveupdate path, specifically in luo_file_unpreserve_files() and luo_file_finish(). The issue was improper ordering of module_put() and xa_erase() which could affect a file handler module while its operations were accesse...

CVE-2026-74368

The CVE-2026-74368 entry documents a memory leak in the Linux kernel’s ath12k wifi path (ath12k_wifi7_dp_rx_h_verify_tkip_mic) triggered when NWIFI header length validation fails. The root cause is a false return from ath12k_dp_rx_check_nwifi_hdr_len_valid() for invalid NWIFI headers, causing ear...

CVE-2026-74367

CVE-2026-74367 describes a Linux kernel vulnerability in the ath12k WiFi driver (ath12k_mac_vdev_create) where three error-paths can leave arvif in an inconsistent state. Specifically: (1) on failure of ath12k_wmi_vdev_create, arvif->ar isn’t cleared, making vdev readiness checks see a non-NUL...

CVE-2026-74366

CVE-2026-74366 concerns a NULL dereference in the Linux kernel’s ath12k wifi driver when handling unready links. The issue occurs because a path that validates a MAC channel may not create the vdev, leaving arvif->is_created as false and arvif->ar NULL. Subsequent code paths allocate an ars...

CVE-2026-74365

The CVE-2026-74365 entry describes a race in BTT lane acquisition inside the Linux kernel’s nvdimm subsystem. A spinlock-based per-lane recursion model could be bypassed when preemption occurred, allowing concurrent use of the same lane and risking silent data corruption during BTT I/O. The fix r...

CVE-2026-74363

The CVE-2026-74363 entry concerns a Linux kernel BPF/bpffs use-after-free related to inode cleanup. The root cause was that moved cleanup from ->free_inode() into ->destroy_inode() to avoid sleeping in RCU when calling bpf_any_put(), which inadvertently removed the RCU delay on freeing the ...

CVE-2026-74364

The CVE-2026-74364 issue concerns the Linux kernel’s BPF map-in-map handling. A map created as an exclusive map (excl_prog_hash) is bound to a single program by hash. check_map_prog_compatibility() refuses to load programs unless their digest matches map->excl_prog_sha, but this check only cov...

CVE-2026-74362

In the Linux kernel CVE-2026-74362, the vulnerability stems from ext2_write paths where ext2_dio_write_iter() does not propagate the error returned by generic_write_sync(), potentially causing write(2) to report success for O_SYNC/O_DSYNC files even when the sync failed. The corrective pattern is...

CVE-2026-74360

The CVE-2026-74360 entry describes a Linux kernel vulnerability in BPF iterators: bpf_map_elem iterators bind their target map at attach time, bypassing the exclusivity check enforced by check_map_prog_compatibility() for excl_prog_hash. This can undermine the intended isolation of exclusive maps...

CVE-2026-74361

The CVE-2026-74361 entry covers a Linux kernel issue in the NVMe subsystem: the FDP fdpcidx bounds check incorrectly used > instead of >=, allowing fdp_idx when it equals NUMFDPC+1. The vulnerability is resolved by the patch in the referenced kernel commits (fix bounds check in fdpcidx). Th...

CVE-2026-74359

In CVE-2026-74359, the Linux kernel fixes a use-after-free in configfs_lookup where a dangling ->s_dentry can be observed after inode allocation failure. The root cause was that, on certain failure paths, the dentry’s link to a configfs_dirent wasn’t cleared, leaving a pointer in ->s_dentry...

CVE-2026-74358

CVE-2026-74358 concerns the Linux kernel ext4 fast-commit wait/wake bit mapping on 64-bit. The vulnerability arises because ext4 dynamic inode states live in the upper half of i_flags on 64-bit, and ext4_test_inode_state() applies a +32 offset. The fast-commit wait and wake paths previously used ...

CVE-2026-74357

CVE-2026-74357 (Linux kernel, amdgpu) : The vulnerability arises in the amdgpu_coredump path where two passes over adev->rings[] count and copy ring data using the same skip condition. Because last_seq is updated concurrently by the fence signalling path, rings may transition from signalled to...

CVE-2026-74356

CVE-2026-74356 concerns the Linux kernel vhost subsystem. The issue is that vhost_get_avail_idx incorrectly reported whether all entries were consumed instead of whether new entries were added to the virtqueue, particularly affecting drivers/vhost/net.c when mergeable buffers are enabled. This mi...

CVE-2026-74355

In the Linux kernel vulnerability CVE-2026-74355, the issue occurs in iommu/vt-d where the info->node RB-tree is zero-initialized via kzalloc. If ATS is not supported, device_rbtree_insert() is skipped, and on a later failed probe step, device_rbtree_remove() can misinterpret the zeroed node a...