CVE-2026-74391

In CVE-2026-74391, the Linux kernel tracing subsystem is affected by a buffer-overflow risk in synthetic-field string construction. The vulnerability arises because synthetic field helpers append strings with strcat() to fixed MAX_FILTER_STR_VAL buffers, allowing long key lists, field names, or s...

CVE-2026-74390

CVE-2026-74390 affects the Linux kernel’s RDMA/irdma path. The vulnerability stems from an out-of-bounds write in irdma_copy_user_pgaddrs, which iterates over umem DMA blocks to fill PBLEs. When irdma_setup_pbles is called with lvl==0, the loop may not exit properly if palloc->total_cnt == 0, ...

CVE-2026-74389

Summary: CVE-2026-74389 affects the Linux kernel RDMA driver for HNS (hns_roce). When hns_roce_cmd_mbox() fails, the error path could flood logs due to unlimited ibdev_err/ibdev_warn outputs, potentially leading to a system crash. The fix replaces the non-limited error prints with ratelimited ver...

CVE-2026-74388

The CVE-2026-74388 issue affects the Linux kernel ALSA: seq: oss component, where SysEx handling in the OSS sequencer could lead to a use-after-free if a sequencer port closes during dispatch. The root cause is a stale pointer in a pending event held after input MIDI bytes are turned into a seque...

CVE-2026-74387

Summary of CVE-2026-74387 (Linux kernel, ALSA: seq: midi) : The vulnerability stems from improper synchronization in MIDI event handling. Specifically, event_process_midi() borrows msynth->output_rfile.output and passes the substream to dump_midi() and snd_rawmidi_kernel_write() without coordi...

CVE-2026-74385

CVE-2026-74385 affects the Linux kernel’s nvmet-tcp component. The vulnerability arises because nvmet_tcp_set_queue_sock() return value is ignored in nvmet_tcp_tls_handshake_done(), so if the call fails (e.g., socket not TCP_ESTABLISHED), socket callbacks aren’t set and queues/sockets can leak. T...

CVE-2026-74386

CVE-2026-74386 affects the Linux kernel nvmet-tcp component. The root cause is a page fragment cache leak in the error path of nvmet_tcp_alloc_queue(): if a connection closes during allocation (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN), error handling jumps to out_destroy_sq and then ou...

CVE-2026-74384

CVE-2026-74384 details a Linux kernel issue in nvme-multipath where a flexible array member current_path[] in struct nvme_ns_head is indexed by NUMA node IDs but allocated using num_possible_nodes(). On POWER systems with sparse NUMA IDs, this can lead to out-of-bounds accesses. The mitigation is...

CVE-2026-74382

CVE-2026-74382 concerns a stack overflow in the Linux kernel’s net/sched cls_bpf offload rollback. The issue arises when cls_bpf_offload_cmd() recursively re-enters during rollback if tc_setup_cb_replace() fails twice in a row, allowing unbounded recursion until the stack is exhausted. Two propos...

CVE-2026-74383

The CVE-2026-74383 issue is a Linux kernel vulnerability in nvme_setup_descriptor_pools where nvme_setup_descriptor_pools() index uses hctx->numa_node (-1 on non-NUMA) with an unsigned parameter, causing UINT_MAX and an out-of-bounds access on the descriptor_pools[] array. The result can fault...

CVE-2026-74381

The CVE-2026-74381 entry describes a Linux kernel vulnerability in gpu: host1x where entries in BO caches could be freed. A mapping pinned via host1x_bo_pin() with a cache kept a reference to the underlying host1x_bo, preventing theBO from being freed as long as cached. The fix introduces a weak ...

CVE-2026-74380

CVE-2026-74380 involves the Linux kernel gpu: host1x path where iommu_map_sgtable() return value check was fixed. The change switches iommu_map_sgtable() to return an ssize_t and to return negative error codes instead of a size_t zero, and pin_job() now correctly handles errors (previously might ...

CVE-2026-74379

CVE-2026-74379 affects the Linux kernel dax/kmem driver. The root cause is a partial success in dev_dax_kmem_probe() where at least one resource range is mapped but a subsequent range fails, leading to the range resource being NULL and the probe reporting success. Consequently, dev_dax_kmem_remov...

CVE-2026-74378

CVE-2026-74378 affects the Linux kernel RDMA/rxe path: get_srq_wqe() reads wqe->dma.num_sge from a shared userspace-mapped buffer. The issue is a TOCTOU heap overflow caused by validating num_sge against max_sge and then re-reading the same field to compute memcpy size, allowing a concurrent u...

CVE-2026-74376

CVE-2026-74376 affects the Linux kernel in the md/raid10 path. The issue arises when reusing an r10bio for discard: if discard reuses an r10bio that previously handled a read, read_slot may remain non-negative and discard cleanup could skip releasing the replacement bio. The documented fix resets...

CVE-2026-74377

CVE-2026-74377 affects Linux kernel RDMA/rxe in non-SRQ receive path. The issue arises when the responder reads WQE fields directly from a userspace-mapped shared queue, allowing a malicious user to modify fields such as num_sge or sge entries while the kernel processes the WQE, leading to out-of...

CVE-2026-74375

In the Linux kernel, md/raid1 and raid10 components were hardened to prevent a deadlock during read-error recovery. Specifically, when handling a read error, raid1d/raid10d could resubmit a split md cloned bio while an array is suspended, and attempt to acquire a second active_io reference via pe...

CVE-2026-74374

CVE-2026-74374 affects the Linux kernel’s md/raid1 and md/raid10 code paths. The fix replaces error-path detection that relied on r1_bio or raid10’s read_slot with md_cloned_bio(), addressing cases where the error path is NULL or -1 after bio splitting/resubmission. The consequence previously cou...

CVE-2026-74372

CVE-2026-74372 concerns the Linux kernel RAID1 code path. In raid1_write_request(), every per-mirror iteration starts by incrementing rdev->nr_pending. If a REQ_ATOMIC write hits a badblock within the range, control jumps to err_handle without dropping the reference for the current mirror. The...

CVE-2026-74373

The CVE-2026-74373 entry documents a Linux kernel issue in md/raid1 and raid10 where bio accounting was incorrect for split md cloned bios. The mitigation implemented is to use md_cloned_bio() to detect md cloned bios and skip accounting accordingly, replacing reliance on r1bio_existed (raid1) or...