CVE-2026-74498

CVE-2026-74498 affects the Linux kernel ALSA USB-audio driver. The vulnerability arises from DMA buffer sizing for full-packet transfers: when fill_max is set, data_ep_set_params() promotes ep->curpacksize to ep->maxpacksize, but maxsize remains the original value derived from the sample ra...

CVE-2026-74497

CVE-2026-74497 pertains to the Linux kernel, affecting ALSA usb-audio by clamping the frame size in implicit-feedback mode. The root cause is in snd_usb_handle_sync_urb(), which scales sync packet sizes and stores them directly in out_packet->packet_size[i]. If a connected USB device sends an ...

CVE-2026-74495

CVE-2026-74495 affects the Linux kernel igbvf driver. The issue is a leak in TX DMA error cleanup: when mapping TX buffers, buffers already mapped for a skb must be unmapped. The root cause is an off-by-one error from decrementing the count before the dma_error loop, after the count had been incr...

CVE-2026-74496

Linux kernel vulnerability CVE-2026-74496 affects the Fou (FOU) path. fou_create() publishes the fou struct via sk_user_data before the new FOU port is added to the per-netns list; if fou_add_to_port_list() fails, fou is freed while still reachable through sk_user_data, allowing a concurrent rece...

CVE-2026-74494

CVE-2026-74494 relates to ksmbd in the Linux kernel. Unauthenticated clients can issue multiple SMB2 NEGOTIATE requests on a single connection before SESSION_SETUP; during KSMBD_SESS_NEED_SETUP, smb2_handle_negotiate() may accept another SMB3.1.1 NEGOTIATE and overwrite conn->preauth_info, cau...

CVE-2026-74492

The CVE-2026-74492 entry concerns the Linux kernel netfilter ipset subsystem. Technical description across official and vendor advisories shows that during resize operations, mtype_resize() copies only comment pointers, while the old table is published for packet-side updates before the replaceme...

CVE-2026-74493

CVE-2026-74493 affects the Linux kernel net/smc subsystem. The issue is a use-after-free during link group termination in __smc_lgr_terminate: conns_lock is dropped after locating a connection but before taking a reference on its socket. Since the socket is embedded in the connection and the regi...

CVE-2026-74490

CVE-2026-74490 affects the Linux kernel’s TIPC subsystem. According to multiple sources (NVD, SUSE, Debian, OSV, PT Security, EUVD), the issue is a use-after-free in the poll trace path where tipc_poll() can trigger queue dumps (tipc_list_dump) while an skb may be dequeued and freed in an unlocke...

CVE-2026-74491

The CVE-2026-74491 entry describes a Linux kernel vulnerability where a NULL bus dereference could occur in the PCI range parser (of_pci_range_parser_one) due to the bus matching rework: of_match_bus() could return NULL for nodes with ranges/dma-ranges but no local #address-cells. The fix rejects...

CVE-2026-74489

CVE-2026-74489 describes a use-after-free in the Linux kernel’s wifi mac80211 stack (tid_tx) during BA session stop. The bug occurs when ieee80211_stop_tx_ba_cb() hands tid_tx to kfree_rcu() via ieee80211_remove_tid_tx(), then reads tid_tx->ndp after dropping sta->lock. The read happens out...

CVE-2026-74487

CVE-2026-74487 – Linux kernel (binfmt_misc) write-denial leak fixed . The issue affected the binfmt_misc handler in the Linux kernel: registering an entry with the MISC_FMT_OPEN_FILE flag opens the interpreter via open_exec(), which denies write access for the lifetime of the entry. When the entr...

CVE-2026-74488

CVE-2026-74488 affects the Linux kernel’s mwifiex TDLS A-MSDU parsing. The vulnerability arises when mwifiex_11n_dispatch_amsdu_pkt() processes A-MSDU subframes: it passes skb->len (the A-MSDU’s length) to mwifiex_process_tdls_action_frame() instead of rx_skb->len (the actual subframe lengt...

CVE-2026-74486

The CVE-2026-74486 entry describes a Linux kernel vulnerability in binfmt_misc where load_misc_binary() clones the interpreter file and denies write access with exe_file_deny_write_access(), while the exec path later calls exe_file_allow_write_access(). This mismatch can cause repeated write-deni...

CVE-2026-74484

CVE-2026-74484 concerns the Linux kernel’s binfmt_misc feature: an entry registered with the character 'F' can cause the interpreter to pin itself, preventing proper unregistration and leading to a DoS with leaked resources (including user namespaces). The issue arises when the interpreter’s file...

CVE-2026-74485

Summary of CVE-2026-74485 (binfmt_misc delimiter issue) : In the Linux kernel, a vulnerability in binfmt_misc allowed a crafted registration string to cause an out-of-bounds read when the delimiter chosen by the user was itself a flag character (one of P, O, C, F). The padding after create_entry(...

CVE-2026-74482

CVE-2026-74482 — Linux kernel (mm/huge_memory) . The issue arises during THP folio splitting in mm/huge_memory.c: __folio_split dereferences the mapping after the split while folios are still frozen/locked, and calls remap_page() and shmem_uncharge() before unlocking the after-split folios. This ...

CVE-2026-74483

CVE-2026-74483 affects the Linux kernel: binfmt_misc may leak a user namespace across mounts when bm_fill_super() fails. The root cause is improper ownership transfer of the user namespace through s_fs_info leading to a leak, which is mitigated by dropping the reference in kill_sb() so the namesp...

CVE-2026-74481

The CVE-2026-74481 entry describes a Linux kernel UAF/GPF during PM suspend caused by page_reporting work being scheduled on the non-freezable system_wq. Child devices (e.g., virtio_balloon) delete virtqueues as part of suspend, but page_reporting_process could still run, triggering virtballoon_f...

CVE-2026-74480

CVE-2026-74480 affects the Linux kernel networking bridge code. The fast-leave path in br_multicast_leave_group() can dereference a stale mp->ports entry after br_multicast_del_pg() removes a port group, enabling a scenario where multiple port groups for the same port/group with different sour...

CVE-2026-74479

CVE-2026-74479 — Linux kernel pktgen use-after-free : Multiple sources describe a race in proc entry handling inside pktgen where pktgen_change_name() mutates pkt_dev->entry under t->if_lock while pktgen_remove_device() can race to remove the same entry, enabling a use-after-free in proc_re...