CVE-2026-74258

Summary (CVE-2026-74258): The Linux kernel patch fixes a vulnerability in the BPF upprobe path where __get_user could read user-space data without proper bounds checks. The root cause is missing bounds validation prior to using __get_user in uprobe_multi data; the fix adds an access_ok check to v...

CVE-2026-74257

CVE-2026-74257 stems from a use-after-free in the Linux kernel sockmap path (udp_bpf_recvmsg) where sk_msg_recvmsg() can touch the same sk_msg when multiple threads race. The mitigation described in connected docs is to serialize sk_msg_recvmsg() by callers, specifically by adding a lock around u...

CVE-2026-74255

The CVE affects the Linux kernel’s TIPC path, detailing a use-after-free in ipvlan_hard_header() invoked from tipc_l2_send_msg(). The root cause is tipc_disable_l2_media() calling synchronize_net() while b->media_ptr is still valid, allowing concurrent RCU readers to obtain a freed device poin...

CVE-2026-74256

The CVE-2026-74256 family affects the Linux kernel’s BPF sockmap path, where bpf_msg_pop_data() bounds checks used 32-bit arithmetic on start/len. An unsigned-to-signed overflow could allow an out-of-range start/len, causing the pop loop to walk past scatterlist end and trigger put_page on an emp...

CVE-2026-72502

The CVE-2026-72502 issue affects the Linux kernel TCP/IPv6 path: when MTU is large, ip6_default_advmss() could return IPV6_MAXPLEN (65535), which TCP could treat as mss_clamp, allowing an MSS of 65535. The bug also coalesces with GSO_BY_FRAGS (0xFFFF), causing a NULL pointer dereference if a TCP ...

CVE-2026-72500

The CVE-2026-72500 vulnerability in the Linux kernel affects RDMA/bnxt_re and related code paths (bnxt_qplib_destroy_srq) where a toggle page is freed before firmware teardown completes. The root cause is freeing the page too early, allowing an NQ interrupt arriving during bnxt_qplib_destroy_srq(...

CVE-2026-72501

The CVE-2026-72501 entry concerns the Linux kernel’s RDMA/bnxt_re code path. The bug was that the dpi variable was initialized only for BNXT_RE_ALLOC_WC_PAGE and then copied in other cases, potentially leaving an uninitialized dpi. The fix initializes dpi to 0 across all paths, resolving the issu...

CVE-2026-72498

The CVE-2026-72498 entry affects the Linux kernel's RDMA driver bnxt_re. The issue concerns the dumping of MR info with the rdma tool, where the mr_hwq (a kernel pointer) was exposed to end users. The vulnerability was resolved by avoiding display of the kernel pointer when dumping MR information...

CVE-2026-72499

The CVE-2026-72499 issue is in the Linux kernel RDMA bnxt_re path. The vulnerability is resolved by changing the teardown order: free_page() is moved to occur after bnxt_qplib_destroy_cq(), so an NQ interrupt arriving during CQ destruction won’t write to an already-freed toggle page. Affected com...

CVE-2026-72497

CVE-2026-72497 concerns the Linux kernel RDMA/bnxt_re path. The description states a fix was implemented to validate the WQE mode against the hardware-supported maximum slots (64K), adding both a max and min check and failing if the user-supplied value exceeds the max or is zero. The vulnerabilit...

CVE-2026-72496

CVE-2026-72496 affects the Linux kernel RDMA/bnxt_re path. The root cause is in bnxt_qplib_alloc_dpi returning success when ioremap fails; the fix adds proper rollback on ioremap failure and returns -ENOMEM. The published metrics indicate a CRITICAL base score (CVSS 3.1: AV:L/AC:L/PR:N/UI:N/S:C/C...

CVE-2026-72495

CVE-2026-72495 affects the Linux kernel’s RDMA/bnxt_re path. The vulnerability arises from allowing multiple WC pages for the same ucontext; only 1 WC page per ucontext is supported. The fix adds a lock to prevent concurrent access and a check to fail repeated requests. Additionally, if the mmap ...

CVE-2026-72494

CVE-2026-72494 : In the Linux kernel RDMA/irdma driver, a synchronization issue was resolved by replacing a waitqueue plus request_done flag (lacked proper memory barriers) with a completion primitive designed for this purpose. The change removes the explicit flag and barriers, relying on the com...

CVE-2026-72493

CVE-2026-72493 concerns a race condition in the Linux kernel where a lockless netif_running() check in enqueue_to_backlog() allowed a TOCTOU window during device backlog flushing on unregistration (e.g., netns exit). The issue can let packets escape backlog processing and trigger a use‑after‑free...

CVE-2026-72492

The CVE-2026-72492 issue concerns ksmbd (Linux kernel) where same_client_has_lease() returns an opinfo pointer from ci->m_op_list after dropping ci->m_lock without holding a reference. smb_grant_oplock() later dereferences this pointer in copy_lease() and while checking breaking_cnt, riskin...

CVE-2026-72491

CVE-2026-72491 — Linux kernel net/9p rdma state race fixed. The rdma->state field was updated without req_lock in recv_done() and p9_cm_event_handler(), while rdma_request() reads/modifies under req_lock, risking lost transitions and potential use‑after‑free during teardown. The fix adds req_l...

CVE-2026-72490

The CVE-2026-72490 entry concerns the Linux kernel (staging: rtl8723bs) with a fix to the stainfo check in rtw_aes_decrypt. The issue was an incorrect null-pointer guard that returned _FAIL on a valid pointer; the guard was inverted so that it now returns _FAIL on invalid pointers. This change re...

CVE-2026-72488

In the Linux kernel, the soundwire subsystem fixed an out-of-bounds memory access in the sdw_add_element_group_count loop when i == num. The vulnerable code used for (i = 0; i rates[i]/group->lanes[i]. The patch adds a pre-check to verify existing rate/lane entries in the target group before i...

CVE-2026-72489

The CVE-2026-72489 issue affects the Linux kernel staging/nvec code. In nvec_rx_completed(), an incomplete RX transfer could trigger nvec_msg_free() to clear a pool slot, after which the code reads nvec->rx->data[0]. Because the slot may be reallocated concurrently, this leads to a use-afte...

CVE-2026-72487

The CVE describes a Linux kernel PCI ROM access vulnerability in the PCI subsystem that caused crashes when reading ROM data if the ROM space address/size checks are missing. Concrete details in the connected records show: the ROM space started at 0xffa0000007f30000 with size 0x10000, and a readl...