CVE-2026-74301

CVE-2026-74301 documents a fix in the Linux kernel for the Bluetooth btmtk driver where an allocated URB could leak if btmtk_isopkt_pad() fails during alloc_mtk_intr_urb. The remedy is to call usb_free_urb() before returning the error, preventing the URB leak and releasing associated resources. N...

CVE-2026-74300

CVE-2026-74300 affects the Linux kernel Bluetooth HCI codec capability parsing. The issue: when reading Local Codec Capabilities, each capability element starts with a length byte followed by payload; the parser validated only the remaining skb length against caps->len, allowing a malformed re...

CVE-2026-74299

CVE-2026-74299 affects the Linux kernel RDMA/core subsystem. A FRMR aging path could leak an mkey when aging pinned-handle pools move handles between active/inactive queues and a new page allocation fails. The fix adds push_queue_to_queue_locked() to populate the destination tail from the source ...

CVE-2026-74298

CVE-2026-74298 pertains to the Linux kernel, specifically the RDMA/core path. The vulnerability is resolved by fixing the FRMR set pinned push error path and by adding destruction of FRMR handles when pushing to the pool fails, preventing resource leaks if pool page allocation fails. Documents do...

CVE-2026-74297

The CVE-2026-74297 entry details a Linux kernel vulnerability in the RDMA/mlx5 path relating to RQ WQE size calculation. The flaw arises in set_rq_size(), which computes the RQ WQE size as 1 < 32; shifts of 32 are accepted and a shift of 31 can overflow a signed integer, causing undefined beha...

CVE-2026-74295

The CVE-2026-74295 entry concerns the Linux kernel ASoC: codecs/hdac_hdmi path. The vulnerability arose because hdac_hdmi_set_pin_port_mux() indexed the texts array using the written enum value before validating it with snd_soc_dapm_put_enum_double(), which could allow an out-of-range index and r...

CVE-2026-74296

CVE-2026-74296 – Linux kernel RDMA/mlx5 UAR index handling : The affected component is the Linux kernel with the RDMA/mlx5 driver. The described issue is a change in resource management: freeing the UAR index that is provided by hardware rather than the software-supplied index. The impact is reco...

CVE-2026-74294

The CVE-2026-74294 issue affects the Linux kernel ASoC meson AIU: the AIU HDMI and internal codec mux put callbacks could use an out-of-range enum value when calling snd_soc_enum_item_to_val() before validating the enumeration. The vulnerability has been resolved by rejecting out-of-range values ...

CVE-2026-74293

In the Linux kernel ASoC subsystem for Freescale (fsl) audio mixer, CVE-2026-74293 concerns fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src(). These callbacks convert a user-supplied enum item to a value with snd_soc_enum_item_to_val() before validating it against the enum’s item count, w...

CVE-2026-74292

Technical details about CVE-2026-74292 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-74291

CVE-2026-74291 concerns the Linux kernel ASoC topology parser. Affected: PCM/DAI name fields stored in fixed-size UAPI arrays. Root cause: those PCM/DAI paths forwarded non-NUL-terminated or unterminated name strings to C-strings, strlen(), and related lookups without prior bounded checks. Conseq...

CVE-2026-74290

The CVE-2026-74290 issue affects the Linux kernel’s net/sched cls_flow flow classifier. The vulnerability arises because, in map mode, userspace can manipulate mask, xor, rshift, addend and divisor and observe the resulting classid via statistics, enabling a tc classifier in a user/network namesp...

CVE-2026-74289

CVE-2026-74289 (Linux kernel) : A use-after-free bug occurs when dumping IPv4 fib_info under RCUs because fib_info_hold()/refcount_inc() are called while lifetime can’t be guaranteed. Affected: nsim_fib4_prepare_event(), mlxsw_sp_router_fib4_event(), rocker_router_fib_event(), and related fib_tri...

CVE-2026-74287

The in-kernel SCTP fix validates the embedded address parameter length in INIT/ASCONF paths. Previously, sctp_verify_asconf()/sctp_verify_param() checked only the outer parameter size and allowed an embedded address length to exceed the outer bounds, enabling potential out-of-bounds reads. The re...

CVE-2026-74288

The vulnerability CVE-2026-74288 affects the Linux kernel, specifically in the networking subsystem’s fib_rules handling. The issue arises in net: fib_rules_dump() when rocker_router_fib_event() calls fib_rule_get() during an RCU dump and encounters a dying fib_rule whose refcount is zero or bein...

CVE-2026-74286

Summary: The CVE-2026-74286 issue affects the Linux kernel PFCP netdevs. The root cause is that PFCP uses dev_get_tstats64() for stats, but pfcp_link_setup() did not request NETDEV_PCPU_STAT_TSTATS, leaving dev->tstats NULL. As a result, creating a PFCP rtnetlink device could prematurely query...

CVE-2026-74284

The CVE concerns the Linux kernel net/sched sch_hfsc subsystem. A bug could cause a class to be passived twice during a single dequeue: update_vf() is invoked twice for the same class (from hfsc_qlen_notify(0,0) and then hfsc_dequeue()), and if the child qdisc is empty, a second go_passive is arm...

CVE-2026-74285

CVE-2026-74285 describes a Linux kernel issue where netif_rxq_cleanup_unlease() tear-down inverted the sequence: it uninstalls the memory provider (clearing dma_addr) before stopping the physical RX queue, allowing a window for DMA to stale/zero addresses via an active queue. The fix swaps the or...

CVE-2026-74282

In the Linux kernel vulnerability CVE-2026-74282, the TIPC stack allows an oversized CONN_ACK to cause snt_unacked to underflow. The root cause is tipc_sk_conn_proto_rcv() subtracting the peer-supplied ack count from an unsigned 16-bit snt_unacked without ensuring it does not exceed the outstandi...

CVE-2026-74283

The CVE covers the Linux kernel TIPCv2 netlink mutators, which earlier registered mutating generic-netlink operations without admin permission flags. The documented root cause is that generic-netlink checks for CAP_NET_ADMIN only when GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM are set; unprivileged l...