CVE-2026-74527

CVE-2026-74527 affects the Linux kernel’s octeontx2-af pathway. PF and VF NIX LFs sharing a CGX LMAC can reuse the same hardware PKIND programming; when HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must not reset the PF’s LMAC RX PKIND or default TX parse config. The fix adds cgx_get_pkin...

CVE-2026-74526

In CVE-2026-74526, the Linux kernel fault-handling code for mpi3mr (scsi) had a potential deadlock when GFP_KERNEL allocations in mpi3mr_fault_uevent_emit could trigger memory reclaim while host I/O was blocked. The fix covers the entire call with memalloc_noio_save()/restore(), replacing the pre...

CVE-2026-74525

CVE-2026-74525 affects the Linux kernel net sxgbe driver. When RX descriptor ring allocation fails, init_dma_desc_rings() frees partial RX rings but leaks TX rings allocated earlier. The fix rearranges error labels to clean up TX rings on RX failure. Affected component: net/sxgbe RX/TX ring initi...

CVE-2026-74524

CVE-2026-74524 : In the Linux kernel (RISC‑V), a fix prevents an out‑of‑bounds page‑table walk during memory hot‑remove. When page‑table levels are folded (Sv48 Sv39), remove_pud_mapping/remove_p4d_mapping compute child bases with pud_offset(p4dp,0) / p4d_offset(pgd,0) and then add an index that ...

CVE-2026-74523

Summary: CVE-2026-74523 affects the Linux kernel qede driver with VXLAN/GENEVE tunnels. A TX timeout can cause recovery deadlocks in the driver’s mutex, freezing rtnetlink control for the node. What’s affected: The qede UDP tunnel synchronization flow during recovery paths, where recovery nested ...

CVE-2026-74521

The CVE-2026-74521 vulnerability affects the Linux kernel’s ksmbd component, where ClientGUIDs were compared with strncmp() and could misclassify distinct GUIDs that contain embedded NUL bytes. The fix uses memcmp() to compare all SMB2_CLIENT_GUID_SIZE bytes in SMB3 multichannel session binding a...

CVE-2026-74522

The CVE-2026-74522 entry describes a Linux kernel ksmbd use-after-free in __close_file_table_ids(). A ksmbd_file can stay alive after logical close while another session holds a temporary reference, leading to a potential use-after-free when the final ksmbd_fd_put() path frees the object without ...

CVE-2026-74520

The CVE-2026-74520 issue is in the Linux kernel’s iommu/iommufd path, where iopf_group_alloc() links the last-page IOPF group into the generic pending list and iommufd_fault_iopf_handler() queues an accepted group in the IOMMUFD deliver list without removing it from the generic list. When a devic...

CVE-2026-74519

CVE-2026-74519 describes a Linux kernel vulnerability in the pinctrl devicetree handling: dt_remember_or_free_map() may free uninitialized dev_name entries if kstrdup_const() fails, leading to a KASAN double-free during cleanup in dt_free_map. The issue arises when pinctrl drivers (e.g., pinctrl-...

CVE-2026-74518

CVE-2026-74518 — Linux kernel: mm/hugetlb list corruption in allocate_file_region_entries() fixed. The bug allowed a corrupted resv->region_cache when top‑up relied on list_splice() leaving a stale source head during a retry loop under concurrent mappings of hugetlbfs. The fix uses list_splice...

CVE-2026-74516

The CVE-2026-74516 issue affects the Linux kernel (KVM/SMV) where, if AVIC is inhibited while L2 is active, the host may run L1 with AVIC disabled and with x2APIC MSR intercepts also disabled. This allows L1 to access the host APIC state, trigger arbitrary interrupts, modify task priority, and co...

CVE-2026-74517

CVE-2026-74517 : Linux kernel/KVM local issue where delaying and later processing of I/O APIC EOI during VM destruction could cause a use-after-free. The documented fix cancels and flushes the delayed EOI work in the pre-destroy phase before vCPUs are destroyed to prevent injecting IRQs after des...

CVE-2026-74515

CVE-2026-74515 concerns the Linux kernel, specifically KVM on s390 for PCI (zPCI). The issue arises when enabling adapter interrupt forwarding: the MPCIFC instruction forbids registering interrupts without unregistering first, so a second or repeated enable request for the same device is rejected...

CVE-2026-74513

CVE-2026-74513 affects the Linux kernel where a use-after-free can occur in dibs loopback handling due to a race between hash-table lookup and refcount teardown of dmb_node. The fix makes hash table membership and refcount transitions atomic: final refcount_dec_and_test() and hash_del() are perfo...

CVE-2026-74514

Summary of CVE-2026-74514 (Linux kernel, KVM on s390): The issue arises in memory accounting for pinned/unpinned pages where account_mem() and unaccount_mem() call get_uid() multiple times without corresponding free_uid() calls, potentially leaving a reference on the wrong process context. The bu...

CVE-2026-74512

CVE-2026-74512 is a Linux kernel use-after-free in audit_del_rule() during rule deletion. The issue arises when audit_del_rule() destroys e->rule.exe via audit_remove_mark_rule() before unlinking the rule from RCU-visible lists and waiting for a grace period, allowing concurrent readers in aud...

CVE-2026-74511

A use-after-free vulnerability exists in the Linux kernel's Bluetooth management (mgmt) subsystem . The root cause is a race condition in pending_eir_or_class(), which failed to include MGMT_OP_SET_LOCAL_NAME as an EIR/class-affecting command and walked hdev->mgmt_pending without holding hdev-...

CVE-2026-74510

CVE-2026-74510 affects the Linux kernel Bluetooth mgmt subsystem. It describes a use-after-free (UAF) in pair command cancellation: pairing completion and authentication failure callbacks could dereference a command freed due to races on the shared mgmt_pending list. The root cause is a lookup th...

CVE-2026-74508

CVE-2026-74508 affects the Linux kernel Bluetooth HIDP path. The bug occurs in hidp_recv_ctrl_frame() and hidp_recv_intr_frame(): they read skb->data[0] before verifying the L2CAP SDU header, enabling an uninitialized-byte use from skb tailroom when an empty basic-mode SDU is received or when ...

CVE-2026-74509

The CVE applies to the Linux kernel Bluetooth HCI path for extended advertising. Root cause: hci_find_adv_instance() can return an adv_info pointer that remains valid only while hdev->lock is held, but advertisement data paths perform lookups without that lock and may retain the pointer while ...