CVE-2026-74430

The CVE-2026-74430 issue affects the Linux kernel’s rxrpc ACKALL handling. It allowed a forged ACKALL to reach a new service call before replies were queued, risking a null-pointer dereference when rxrpc_rotate_tx_window() dereferenced a NULL txqueue (call->tx_top was zero). The fix adds two c...

CVE-2026-74427

The CVE-2026-74427 entry concerns the Linux kernel AFS subsystem. Affected component: afs code handling network namespaces and preallocation charging. Root cause: during netns teardown, the work item that precharges the rxrpc queue could remain active, and when net->live is false the charging ...

CVE-2026-74428

The CVE-2026-74428 entry pertains to the Linux kernel, specifically a vulnerability in rxrpc_recvmsg() where a double unlock occurs while handling OOB messages. The issue is concrete: the function path for OOB messages can unlock a resource twice, potentially leading to memory corruption or simil...

CVE-2026-74426

CVE-2026-74426 (Linux kernel) : A NULL pointer dereference in the AFS filesystem during afs_get_tree() was fixed. The root cause involved afs_alloc_sbi() using kzalloc and, if ctx->dyn_root is non-null, as->cell and as->volume being null, leading to dereferencing these fields in trace_af...

CVE-2026-74425

In the Linux kernel, CVE-2026-74425 affects the AFS cache manager: CB.InitCallBackState3 requests could arrive without an attached server record to the rxrpc peer’s app data. The fix makes CB.InitCallBackState3 follow the same pattern as other callbacks by checking for an attached server record b...

CVE-2026-74424

CVE-2026-74424 affects the Linux kernel framebuffer console driver (fbcon). The issue arises when fbcon_new_modelist() iterates consoles with fb_display[i].mode set; it can dereference a NULL vc_data because fbcon_set_disp() may set mode before validating vc_data, and fbcon_deinit() can leave the...

CVE-2026-74423

The CVE-2026-74423 issue is in the Linux kernel, specifically accel/amdxdna: there is a leak when pin_user_pages_fast() pins fewer pages than requested. The pages that were successfully pinned are not released on failure. The documented fix unpins any partially pinned pages before returning failu...

CVE-2026-74422

In CVE-2026-74422, the Linux kernel’s drm/rockchip inno-hdmi encoder uses a device-managed allocation (devm_kzalloc) for its internal structure during component_bind_all. When the DRM device reference is dropped (drm_dev_put) and drmm_encoder_alloc_release runs, the encoder structure may have bee...

CVE-2026-74421

CVE-2026-74421 affects the Linux kernel drm/rockchip driver, specifically the dw_dp encoder path. The encoder structure was allocated with devm_kzalloc() during component_bind_all(), while cleanup is triggered via drmm_encoder_cleanup() on drm_encoder_cleanup() registered through drmm_add_action(...

CVE-2026-74419

The CVE-2026-74419 issue affects the Linux kernel in accel/amdxdna: copy_to_user() could return more data than the user buffer, potentially exposing more data or failing when the app buffer is smaller. The root cause is not clearly detailed beyond “adjust size for copy_to_user()” and that the amo...

CVE-2026-74420

CVE-2026-74420 is a Linux kernel issue in drm/gpusvm. The vulnerability occurs when creating SVM ranges on VMAs marked VM_IO or VM_PFNMAP, which are not backed by struct page objects that GPUSVM relies on. As a result, get_pages() may fail repeatedly and cause an infinite loop inside a driver’s p...

CVE-2026-74418

CVE-2026-74418 covers a Linux kernel issue in the dma-fence tracepoints where Trace_dma_fence_signaled, trace_dma_fence_wait_end, and trace_dma_fence_destroy could dereference a null fence->ops after signalling. The fix uses safe string getters for most tracepoints and moves signaling logic be...

CVE-2026-74417

CVE-2026-74417 affects the Linux kernel DRM/Radeon path, specifically the radeon_align_pitch() routine. The issue is an integer overflow in the alignment round-up and the final pitch calculation that can yield an invalid pitch or a zero-sized dumb buffer in radeon_mode_dumb_create(). The fix intr...

CVE-2026-74416

CVE-2026-74416 affects the Linux kernel DRM/Radeon stack. The vulnerability is a memory-leak in radeon_ring_restore() on lock failure: radeon_ring_restore() takes ownership of the buffer allocated by radeon_ring_backup(), but when radeon_ring_lock() fails it returns early and does not kvfree(data...

CVE-2026-74415

CVE-2026-74415 concerns the Linux kernel SPI driver for atcspi200. The root cause is a use-after-free during driver unbind when DMA resources are initialized after SPI controller registration, causing DMA teardown while the controller is still active and may trigger DMA transfers. The vulnerabili...

CVE-2026-74413

The CVE-2026-74413 issue affects the Linux kernel wifi driver rtW89, where AER error handlers incorrectly retrieved a pointer stored with pci_set_drvdata as a net_device instead of the ieee80211_hw pointer, causing operations on the wrong offsets in netif_device_detach/attach. The fix aligns the ...

CVE-2026-74414

CVE-2026-74414 affects the Linux kernel (hfsplus) where a null-pointer dereference could occur during setxattr if the attributes file is not loaded at mount time. The root cause is a duplicate attr inode dirty-marking action in hfsplus/xattr.c, leading to a potential dereference in hfsplus_setxat...

CVE-2026-74412

Summary (CVE-2026-74412) : In the Linux kernel, the wifi driver rtw88 had a type mix-up in AER handlers: an ieee80211_hw pointer was stored with pci_set_drvdata() but later retrieved as a net_device pointer. This caused netif_device_detach/attach to operate on an ieee80211_hw struct, accessing wr...

CVE-2026-74411

The CVE affects the Linux kernel with the wifi driver rtw89 (rtw89_core). The vulnerability arises in the 6 GHz scan path where the 6GHz channel-list scan loop uses an incorrect data type for the scan index, leading to an infinite/long loop and a soft lockup (CPU stuck for ~26s) during wifi scans...

CVE-2026-74410

The CVE concerns the Linux kernel wireless driver stack for the rtw88 PCI path. A new_len calculation in rtw_pci_rx_napi() can exceed the pre-allocated DMA receive buffer when assembling data from firmware RX descriptors: new_len = pkt_len (14-bit, up to 16383) + pkt_offset (drv_info_sz + shift, ...