CVE-2026-74318

CVE-2026-74318 concerns the Linux kernel, specifically a deadlock in btrfs when cloning an inline extent while using the flushoncommit option. The issue occurred during reflink/transaction commit, where copying inline extent data to a destination file could deadlock if the destination offset was ...

CVE-2026-74317

CVE-2026-74317 : In the Linux kernel, the ixgbe driver incorrectly configures XDP TX queues via netif_set_xps_queue, causing a KASAN slab-out-of-bounds and a warning during XDP program load on systems with many CPUs. The fix is to skip XPS configuration for XDP TX queues. The vulnerability is res...

CVE-2026-74316

The CVE-2026-74316 entry describes a Linux kernel vulnerability in NFSD: nfsd4_drop_revoked_stid() has no SC_TYPE_LAYOUT handling. When a client sends FREE_STATEID for an admin-revoked layout stid, the default branch does not unhash or release the stid, leaving it in the IDR and per-client list u...

CVE-2026-74315

CVE-2026-74315 (Linux kernel) : The vulnerability arises in lockd/nlm4svc_lookup_file where file_handle hashing used the first LOCKD_FH_HASH_SIZE bytes of nfs_fh.data regardless of fh.size, causing inconsistent bucket lookups when a client presents a shorter file handle. A commit changed populati...

CVE-2026-74313

The CVE-2026-74313 issue affects the Linux kernel under the VDUSE path. Specifically, vduse_dev_open() currently looks up a vduse_dev via an IDR lookup and then acquires dev->lock after vduse_lock is dropped, creating a window where VDUSE_DESTROY_DEV could remove and free the same object befor...

CVE-2026-74314

CVE-2026-74314 relates to the Linux kernel BPF map value handling. The description shows a fix for canceling field cleanup on map value recycle: during updates/deletes, fields no longer are eagerly freed via bpf_obj_free_fields(); instead, bpf_obj_cancel_fields() performs only NMI-safe cleanup fo...

CVE-2026-74312

The CVE-2026-74312 entries describe a Linux kernel vulnerability in vhost/vdpa where mmap and fault paths use vma->vm_pgoff as a virtqueue index without proper bounds validation against v->nvqs. This allowed an out-of-range queue index to reach driver callbacks via get_vq_notification(), un...

CVE-2026-74311

CVE-2026-74311 affects the Linux kernel virtio rtc path. The bug occurs when viortc_restore() calls viortc_init_vqs() without removing old virtqueues, enabling vp_del_vqs() to reference a NULL info pointer in vp_del_vq() and crash the guest kernel during restore. The fix deletes stale virtqueues ...

CVE-2026-74310

The CVE affects the Linux kernel vhost/net zerocopy path. The bug arises when vhost_zerocopy_complete() treats every ubuf callback as a completed descriptor, dereferences ubuf->ctx, and updates state while a cloned skb still holds the same ubuf_info refcount. This can allow a backend reset to ...

CVE-2026-74309

The CVE-2026-74309 entry documents a Linux kernel issue in the vdpa/octeon_ep component where interrupt handling incorrectly mapped IRQs to rings. The root cause is assuming irq - irqs[0] to locate the IRQ index; the fix updates the code to look up the IRQ index within oct_hw->irqs, allowing n...

CVE-2026-74308

Summary: CVE-2026-74308 affects the Linux kernel ext4 in the data=journal scenario. The bug was that ext4_journalled_write_end() could call ext4_write_inline_data_end() without verifying EXT4_STATE_MAY_INLINE_DATA, if a prior inline data conversion failed. This could leave i_inline_size unexpande...

CVE-2026-74306

Summary (CVE-2026-74306): In the Linux kernel, the vfio/qat path is affected by a race in qat_vf_resume_write() where a bounds check uses filp->f_pos before taking migf->lock. The code then copies into the migration-state buffer after acquiring the lock and rereading the shared file positio...

CVE-2026-74307

The CVE-2026-74307 entry describes a Linux kernel/ext4 vulnerability in EXT4_IOC_MOVE_EXT where donor file superblock validation is done late (inside mext_check_validity after acquiring inode locks), creating a deadlock with sb_writers during cross-filesystem donor use (e.g., overlayfs). The issu...

CVE-2026-74305

The provided CVE covers a Linux kernel bug in BPF cgroup storage checks for prog arrays. The underlying issue was an incomplete fix in the commit abad3d0bad72, where a program with no cgroup storage could be treated as compatible with any stored storage cookie, enabling a storage-less leaf to tai...

CVE-2026-74304

The CVE-2026-74304 issue affects the Linux kernel Bluetooth hci_qca driver. In qca_setup(), hu->serdev may be NULL for hci_uart attached via non-serdev paths, yet the code unconditionally calls serdev_device_get_drvdata(hu->serdev) and dereferences it, causing a NULL pointer dereference. Th...

CVE-2026-74303

The CVE-2026-74303 issue concerns the Linux kernel Bluetooth stack (hci_qca). A NULL pointer dereference occurs in qca_dmp_hdr() when handling non-serdev devices: hu->serdev is NULL for hci_uart attached via non-serdev paths, yet the function dereferences hu->serdev->dev.driver->name....

CVE-2026-74302

The CVE-2026-74302 issue affects the Linux kernel Bluetooth HCI core, specifically hci_unregister_dev(), where cmd_timer and ncmd_timer are not disabled before freeing the hci_dev, leading to use-after-free. The documented fix adds disable_delayed_work_sync() alongside existing disable_work_sync(...

CVE-2026-74301

CVE-2026-74301 documents a fix in the Linux kernel for the Bluetooth btmtk driver where an allocated URB could leak if btmtk_isopkt_pad() fails during alloc_mtk_intr_urb. The remedy is to call usb_free_urb() before returning the error, preventing the URB leak and releasing associated resources. N...

CVE-2026-74300

CVE-2026-74300 affects the Linux kernel Bluetooth HCI codec capability parsing. The issue: when reading Local Codec Capabilities, each capability element starts with a length byte followed by payload; the parser validated only the remaining skb length against caps->len, allowing a malformed re...

CVE-2026-74298

CVE-2026-74298 pertains to the Linux kernel, specifically the RDMA/core path. The vulnerability is resolved by fixing the FRMR set pinned push error path and by adding destruction of FRMR handles when pushing to the pool fails, preventing resource leaks if pool page allocation fails. Documents do...