CVE-2026-74286

Summary: The CVE-2026-74286 issue affects the Linux kernel PFCP netdevs. The root cause is that PFCP uses dev_get_tstats64() for stats, but pfcp_link_setup() did not request NETDEV_PCPU_STAT_TSTATS, leaving dev->tstats NULL. As a result, creating a PFCP rtnetlink device could prematurely query...

CVE-2026-74284

The CVE concerns the Linux kernel net/sched sch_hfsc subsystem. A bug could cause a class to be passived twice during a single dequeue: update_vf() is invoked twice for the same class (from hfsc_qlen_notify(0,0) and then hfsc_dequeue()), and if the child qdisc is empty, a second go_passive is arm...

CVE-2026-74285

CVE-2026-74285 describes a Linux kernel issue where netif_rxq_cleanup_unlease() tear-down inverted the sequence: it uninstalls the memory provider (clearing dma_addr) before stopping the physical RX queue, allowing a window for DMA to stale/zero addresses via an active queue. The fix swaps the or...

CVE-2026-74283

The CVE covers the Linux kernel TIPCv2 netlink mutators, which earlier registered mutating generic-netlink operations without admin permission flags. The documented root cause is that generic-netlink checks for CAP_NET_ADMIN only when GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM are set; unprivileged l...

CVE-2026-74282

In the Linux kernel vulnerability CVE-2026-74282, the TIPC stack allows an oversized CONN_ACK to cause snt_unacked to underflow. The root cause is tipc_sk_conn_proto_rcv() subtracting the peer-supplied ack count from an unsigned 16-bit snt_unacked without ensuring it does not exceed the outstandi...

CVE-2026-74281

CVE-2026-74281 — Linux kernel TIPC inverted service ranges : The vulnerability occurs in tipc_update_nametbl() where a peer’s binding uses lower/upper bounds from the wire without ensuring lower upper to be inserted into the service-range RB-tree in a way that cannot be matched or withdrawn. Thi...

CVE-2026-74280

The CVE-2026-74280 entry concerns the Linux kernel crypto: marvell/octeontx component where DMA cleanup used the wrong loop index. Specifically, the sg_cleanup path unmaps DMA buffers using list[i] instead of list[j], leading to leaking successfully mapped entries and repeatedly unmapping the fai...

CVE-2026-74279

The CVE-2026-74279 issue affects the Linux kernel crypto: cavium/cpt path, where the sg_cleanup error path used list[i] instead of list[j] when unmapping DMA buffers. This incorrect loop indexing could leak entries that were previously mapped and repeatedly unmap the failed entry. The vulnerabili...

CVE-2026-74278

CVE-2026-74278 affects the Linux kernel ALSA seq subsystem. The leak arises from bounce_error_event() always emitting SNDRV_SEQ_EVENT_KERNEL_ERROR with a raw struct snd_seq_event pointer exposed to users. The fix differentiates by client type: for USER_CLIENTS, send SNDRV_SEQ_EVENT_BOUNCE with SN...

CVE-2026-74276

Summary : CVE-2026-74276 documents a Linux kernel SPI/Xilinx driver issue where the TX FIFO size was miscomputed due to querying FULL and relying on the TX FIFO to reflect the actual buffer, ignoring the shift register. The result can be an over-read (example: 17 bytes for a 16-byte FIFO) leading...

CVE-2026-74277

The CVE-2026-74277 issue is in the Linux kernel iommu/dma-iommu code, specifically the P2PDMA path. In iommu_dma_map_sg(), the DMA length for the current scatterlist segment was erroneously taken from the head entry (sg->length) instead of the current entry (s->length). This causes all P2PD...

CVE-2026-74275

The CVE-2026-74275 entry is about the Linux kernel driver cxl/region where cxl_cancel_auto_attach() can access p->targets[] using a potentially negative index cxled->pos. The root cause is that cxled->pos may be set to a negative errno in cxl_region_sort_targets() if cxl_calc_interleave_...

CVE-2026-74273

CVE-2026-74273 affects the Linux kernel’s cxl/region logic. The fix expands the range lock and renames it to a new lock called regions_lock to disable region deletion during two critical windows: between construct_region() and attach_target(), and between device_add() and registering the remove a...

CVE-2026-74274

The CVE-2026-74274 entry concerns the Linux kernel cxl/region auto-discovery logic. A NULL hole in a region’s target array (introduced when an endpoint decoder is removed or detached) could lead to null dereferences (possible Oops: general protection fault) or miscounting targets when lock flags ...

CVE-2026-74272

The CVE-2026-74272 entry details a Linux kernel issue in cxl/region where the sysfs trigger could attempt to delete the same region multiple times and race with kernel teardown. The workaround/patch replaces a per-region devres list with an xarray of regions and uses the existing root-decoder unr...

CVE-2026-74270

The CVE-2026-74270 vulnerability affects the Linux kernel handling of the handshake genl family. The DONE downcall previously performed no privilege check, allowing an unprivileged process that could observe or guess a valid socket to submit DONE with HANDSHAKE_A_DONE_STATUS == 0, causing the ker...

CVE-2026-74271

CVE-2026-74271 affects the Linux kernel’s power supply core. If the device tree property power-supplies has multiple values, accessing psy->supplied_from[i-1] in __power_supply_populate_supplied_from can overrun the supplied_from array. The patch fixes supplied_from allocations to prevent the ...

CVE-2026-74269

CVE-2026-74269 describes a Linux kernel issue where bnxt RX path under XDP head-grow can underflow the skb head when the head is adjusted by -256. The root cause is an underflow in bnxt_rx_multi_page_skb that builds the skb with napi_build_skb(data_ptr - bp->rx_offset, rxr->rx_page_size); b...

CVE-2026-74268

This CVE describes a Linux kernel vulnerability where a child socket can inherit BPF sock_ops cb flags from the listener through sk_clone_lock(), leading to a crash or compromised handling if its setup fails in tcp_v4_syn_recv_sock() or tcp_v6_syn_recv_sock(). The root cause is that, on forced-cl...

CVE-2026-74267

The CVE concerns the Linux kernel’s traffic scheduler (net/sched sch_codel). During a peek when codel drops packets, qdisc_tree_reduce_backlog is called before the qlen is re-incremented, potentially deactivating the parent class while 1 packet remains, risking a wild memory access in certain qdi...