CVE-2026-74566

In CVE-2026-74566, the Linux kernel keyring subsystem has a data-ordering defect: keyring_get_key_chunk() loads a description into the index chunk with the low-address first, while keyring_diff_objects() defines the first differing bit from the low end and folds the absolute byte index into the l...

CVE-2026-74565

Consolidated sources describe CVE-2026-74565 affecting the Linux kernel netfilter nf_tables. The bug arises from a global rhltable for nft_object, enabling access to objects being disassembled from lookup paths across net namespaces and potentially causing use-after-free when nft_obj_destroy() re...

CVE-2026-74564

CVE-2026-74564 concerns Linux kernel netfilter xt_hashlimit, where the XT_HASHLIMIT_RATE_MATCH flag can cause uninitialized access to the burst field in the dsthash_ent union when two or more rules reference the same hashtable. A kernel fix updates the .checkentry path to require the RATE_MATCH m...

CVE-2026-74562

The CVE-2026-74562 issue affects the Linux kernel nexthop code: fib6_check_nh_list() and __nexthop_replace_notify() walk the nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock, while IPv6 RTM_NEWROUTE/RTM_DELROUTE can mutate that list without RTNL and race with ...

CVE-2026-74563

CVE-2026-74563 concerns the Linux kernel RDS TCP binding path. Ongoing code path in rds_tcp_laddr_check() looked up a scoped IPv6 interface with dev_get_by_index_rcu(), released the RCU read lock, and then passed the net_device into ipv6_chk_addr(). After rcu_read_unlock(), a concurrent RTM_DELLI...

CVE-2026-74561

Summary: CVE-2026-74561 is a Linux kernel vulnerability where nh_rt_cache_flush walks an f6i_list without proper locking, racing with unlocked IPv6 route add/delete operations and freeing fib6_info. The fix migrates the sernum update to a broader netns scope by using rt_genid_bump_ipv6() instead ...

CVE-2026-74560

CVE-2026-74560 concerns the Linux kernel XDP stack, specifically the xsk_drop_skb() path for AF_XDP multi-buffer transmissions. The issue arises when an overflow path partially builds multi-fragment skbs, causing buffer addresses to be published incorrectly and leaving buffers untracked in usersp...

CVE-2026-74559

CVE-2026-74559 affects the Linux kernel XDP/AF_XDP path. The issue arises in the xsk_build_skb() flow where, on overflow of descriptors (or invalid descriptors in fragmented packets), the generic transmit path multi-buffer handling could mishandle descriptors. The fix introduces xdp_sock::drain_c...

CVE-2026-74558

CVE-2026-74558 describes a Linux kernel vulnerability in the xsk ZC (zero-copy) batch path. The issue arises when the zero-copy Tx batch parser encounters an invalid descriptor or when a packet exceeds xdp_zc_max_segs. In these cases, descriptors can be misinterpreted, potentially advancing the T...

CVE-2026-74557

CVE-2026-74557 (Linux kernel) affects the SCSI/libiscsi path. The bug occurs in iscsi_scsi_cmd_rsp(): it copies sense data from a target-provided segment that starts with a 2-byte sense length, but the bounds check only verified datalen against senselen. As a result, when datalen equals senselen ...

CVE-2026-74556

CVE-2026-74556 – Linux kernel (scsi: libiscsi_tcp) Technical summary from provided documents: The vulnerability arises in the iSCSI path handling within the Linux kernel where iscsi_tcp_hdr_dissect() places the data segment of several PDUs into the fixed-size conn->data buffer (8192 bytes). Fo...

CVE-2026-74554

Mode C: Affected software: Linux kernel (ath12k wireless stack). Issue: In ath12k_mac_dp_peer_cleanup(), the code clears the ML peer ID slot in free_ml_peer_id_map by indexing with dp_peer->peer_id, which always includes ATH12K_PEER_ML_ID_VALID (BIT13). This causes clear_bit to be called with ...

CVE-2026-74555

CVE-2026-74555 pertains to the Linux kernel, addressing a deadlock in SCSI libsas handling during HA resume and a race in disk wake for hisi_sas controllers. The fix, introduced via a commit sequence around sas_resume_ha_no_sync and sas_drain_work, moves PHYE_RESUME_TIMEOUT notifications to occur...

CVE-2026-74553

CVE-2026-74553 affects the Linux kernel hwmon: (nct6775-core), where NCT6116 was treated like NCT6106, causing a global-out-of-bounds read due to a mis-sized temperature register array. The root cause: NCT6106’s six-address temp register array was used to size NCT6116’s registers, while NCT6116 o...

CVE-2026-74552

CVE-2026-74552 concerns the Linux kernel hwmon lm90 driver. Userspace can read certain sysfs attributes before the driver is fully registered, when data->hwmon_dev is still uninitialized, potentially triggering a NULL pointer dereference. The root cause is that lm90_update_device() and lm90_up...

CVE-2026-74551

CVE-2026-74551 affects the Linux kernel hwmon path for nzxt-smart2. The issue arises when send_output_report() triggers USB HID DMA mapping via hid_hw_output_report(), which maps the output buffer for DMA using usb_interrupt_msg(). On non-coherent CPUs (e.g., ARM/MIPS), flushing/invalidating the ...

CVE-2026-74550

Summary: CVE-2026-74550 affects the Linux kernel’s redirect handling for ICMP/NDISC redirects when peer allocation fails. When inet_getpeer_v4() or inet_getpeer_v6() cannot allocate a peer entry under memory pressure or tree size caps, redirect handlers previously could emit un-rate-limited ICMP/...

CVE-2026-74549

CVE-2026-74549 affects the Linux kernel hwmon nct6775-core driver. The issue arises during nct6116 initialization: data->pwm_num is set to 5, but several NCT6106 weight-related register arrays (e.g., WEIGHT_DUTY_STEP, WEIGHT_TEMP_SEL, WEIGHT_TEMP_*) are only 3 elements long and are assigned to...

CVE-2026-74548

CVE-2026-74548 affects the Linux kernel’s forcedeth driver, where nv_remove() frees per-CPU txrx_stats before unregister_netdev(), allowing a use-after-free for txrx_stats accessed by ndo_get_stats64, the NAPI/xmit data path, and nv_close()/drain until unregistration completes. The fix delays fre...

CVE-2026-74546

CVE-2026-74546 affects the Linux kernel hwmon adt7470 driver. A TOCTOU race can occur if fan data becomes 0 between the FAN_DATA_VALID() check and the FAN_PERIOD_TO_RPM() conversion, causing a divide-by-zero crash. The issue is mitigated by reading fan data once to prevent a concurrent update fro...