CVE-2026-74458

Summary: CVE-2026-74458 affects the Linux kernel can: kvaser_usb_leaf code. The flaw allowed dispatch of variable-length USB commands when a nonzero command shorter than CMD_HEADER_LEN was received; a matching command could be copied into a caller-owned kvaser_cmd using the device-provided length...

CVE-2026-74459

CVE-2026-74459 (Linux kernel) affects the can: etas_es58x driver, specifically es58x_read_bulk_callback(). When RX URB resubmission fails (usb_submit_urb()), the callback currently does not release the allocated coherent transfer buffer, causing a buffer leak. The fixes documented in multiple sou...

CVE-2026-74457

The CVE-2026-74457 entry describes a Linux kernel issue in the can: peak_usb driver where ctrl_idx is derived from rx->len (USB payload). The mask 0x0f allows 0–15, but usb_if->dev[] is only size 2, causing heap out-of-bounds read and kernel panic in IRQ context. The fix adds bounds checks ...

CVE-2026-74455

The CVE-2026-74455 vulnerability in the Linux kernel concerns the peak_usb driver for CAN (uCAN) payloads. pcan_usb_fd_decode_buf() parses multiple CAN records packed in a single USB receive buffer and now requires each record to include the fixed header for its type and validates the CAN payload...

CVE-2026-74456

Summary (CVE-2026-74456): In the Linux kernel, the peak_usb path has a double-free in peak_usb_start() when URB_SUBMIT fails. Each RX URB transfer buffer is allocated with kmalloc() and flagged URB_FREE_BUFFER so that usb_free_urb() frees the transfer buffer. If usb_submit_urb() fails, the error ...

CVE-2026-74454

CVE-2026-74454 affects the Linux kernel driv3rs/drm vc4 by correcting how the overflow slot size is written during binner memory handling. The issue arises when vc4_overflow_mem_work() sets BPOA to a 512KB slot but BPOS stores the size of the entire 16MB binner BO, enabling the PTB to write tile ...

CVE-2026-74452

The CVE-2026-74452 issue affects the Linux kernel DRM Panthor firmware loading. In panthor_fw_load_section_entry(), the copied data size is computed as hdr.data.end - hdr.data.start without validating against the allocated section_size, permitting a crafted firmware to set section->data.size l...

CVE-2026-74453

CVE-2026-74453 (Linux kernel, drm/vc4) : The issue arises in the VC4 tile binning path where the Tile State Data Array (TSDA) for a job’s tile set is left in the binner’s slot between submissions. A 16 MB binner buffer is split into 512 KB slots; TSDA is at the start of each slot and is used by h...

CVE-2026-74451

CVE-2026-74451 affects the Linux kernel DRM panthor path. The root cause is that iface_fw_to_cpu_addr() only verified that the MCU virtual address lies within the shared section, but the returned pointer was used as a full firmware interface structure, allowing out-of-bounds accesses when the add...

CVE-2026-74450

CVE-2026-74450 : In the Linux kernel, the drm/amd/pm path had a use-after-free in amdgpu_dpm_get_pp_table when a concurrent write occurred during a sysfs copy of a driver-owned power table. The root cause was returning a pointer to the driver-owned pptable after dropping the adev->pm.mutex. Th...

CVE-2026-74449

The CVE-2026-74449 issue affects the Linux kernel DRM/AMD display path. A zero-area viewport can lead calculate_mcache_setting to exit with num_mcaches == 0 and mvmpg_width/height == 0, causing a divide-by-zero panic (and potential num_mcaches underflow). The fix changes calculate_mcache_setting ...

CVE-2026-74448

CVE-2026-74448 affects the Linux kernel’s DRM/amdkfd path. When MES is enabled and amdgpu_amdkfd_alloc_kernel_mem() fails during the first queue creation for a process, pqm_create_queue() may return early via a plain return, skipping the error cleanup and leaving a reserved QID bit set in queue_s...

CVE-2026-74447

In the Linux kernel (drm/amdkfd), a uint32_t overflow in EOP ring buffer size alignment was fixed. The issue occurred because eop_ring_buffer_size (u32) is aligned with PAGE_SIZE in kfd_queue_acquire_buffers() using 32‑bit arithmetic, allowing a user size like 0xFFFFF001 to wrap to 0 and bypass t...

CVE-2026-74445

The CVE (CVE-2026-74445) affects the Linux kernel drm/vmwgfx path. The vulnerability arises when vmw_cmd_dx_bind_query() dereferences sw_context->dx_ctx_node->ctx if a DX_BIND_QUERY is submitted with dx_context_handle set to SVGA3D_INVALID_ID, allowing a NULL pointer dereference and kernel ...

CVE-2026-74446

The CVE-2026-74446 issue affects the Linux kernel DRM/AMDKFD path and is triggered in kfd_criu_checkpoint_events() when checkpointing CRIU events. The root cause is that kfd_criu_checkpoint_events() counts entries in p->event_idr without holding p->event_mutex, and later iterates the same I...

CVE-2026-74444

The vulnerability CVE-2026-74444 affects the Linux kernel DRM vmwgfx driver. In vmw_cmd_draw, the header size from user input can cause an unsigned subtraction (header->size - sizeof(cmd->body)) to wrap to ~4 GiB when header->size is undersized, leading to a large maxnum and an out-of-bo...

CVE-2026-74442

CVE-2026-74442 affects the Linux kernel drm/vmwgfx/vkms code. Two code paths in vmw_vkms_init() can leave vmw->crc_workq NULL while the driver is not fully unload-safe, causing a panic when vmw_vkms_cleanup() runs destroy_workqueue(NULL). Fixes: (1) remove the early return so the workqueue is ...

CVE-2026-74443

CVE-2026-74443 affects the Linux kernel DRM/vmwgfx path. The issue in vmw_cmd_dma() computes the DMA suffix location without ensuring header->size can contain both body and suffix, allowing an undersized header to underflow the suffix pointer and later overwrite verified fields of a relocated ...

CVE-2026-74441

CVE-2026-74441 affects the Linux kernel USB Type-C UCSI port unregistration. The issue is a race in port teardown where pending partner work items can race with workqueue destruction, causing use-after-free and potential NULL pointer dereferences. The documented fix enforces strict teardown order...

CVE-2026-74440

Summary: CVE-2026-74440 affects Linux kernel DRM/XE, where a user job could race with kernel operations on external buffer objects (BOs) due to an incomplete dependency model. Root cause: during xe_exec_ioctl(), only the VM’s dma-resv KERNEL slot was added as a dependency, omitting external BOs (...