kernel

Vulnerabilities (14,027)

• CVE-2026-74413HigAug 15, 2026
  affected >= 6.17.0, < 6.18.40fixed 6.18.40

  In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix wrong pci_get_drvdata type in AER handlers rtw89 stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() retrieve it as a net_device pointer.

• CVE-2026-74412HigAug 15, 2026
  affected >= 6.17.0, < 6.18.40fixed 6.18.40

  In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers rtw88 stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() retrieve it as a net_device pointer.

• CVE-2026-74411HigAug 15, 2026
  affected >= 6.4.0, < 6.6.145fixed 6.6.145

  In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89_hw_scan_add_chan_ax for over 20 seco

• CVE-2026-74410HigAug 15, 2026
  affected >= 5.2.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer In rtw_pci_rx_napi(), new_len is computed as the sum of pkt_len (14-bit descriptor field, max 16383) and pkt_offset (drv_info_sz + shif

• CVE-2026-74409HigAug 15, 2026
  affected >= 6.14.0, < 6.18.40fixed 6.18.40

  In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware mac_id in link lookup The mac_id field in RX descriptors is 8 bits wide (0-255), but assoc_link_on_macid[] has only RTW89_MAX_MAC_ID_NUM (128) entries. While the driver

• CVE-2026-74408HigAug 15, 2026
  affected >= 3.1.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10)

• CVE-2026-74407HigAug 15, 2026
  affected >= 5.19.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery (SSR). The crash is a NULL pointer dereference in the MHI teardown path whi

• CVE-2026-74406CriAug 15, 2026
  affected >= 4.7.0, < 6.1.178fixed 6.1.178

  In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). udp_tunnel_sock_release() could set sk->sk_user_data to NULL while vxlan_gro_prepare_receive() is running. Let's check if rcu_dereference_sk_

• CVE-2026-74405HigAug 15, 2026
  affected >= 4.11.0, < 6.18.40fixed 6.18.40

  In the Linux kernel, the following vulnerability has been resolved: OPP: Fix race between OPP addition and lookup A race exists between dev_pm_opp_add_dynamic() and dev_pm_opp_find_freq_exact(): CPU0 (add) CPU1 (lookup) ----------------------------

• CVE-2026-74404HigAug 15, 2026
  affected >= 6.9.0, < 6.12.97fixed 6.12.97

  In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one Sashiko notes: > regarding the bounds check in snp_filter_reserved_mem_regions() > called via walk_iomem_res_desc(): does the check > if ((range_l

• CVE-2026-74403HigAug 15, 2026
  affected >= 6.19.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Check for page allocation failure correctly in TIO Sashiko notes: > if __snp_alloc_firmware_pages() returns NULL under memory pressure, is it > safe to pass it directly to page_address()? > > On

• CVE-2026-74402Aug 15, 2026
  affected >= 5.3.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix blocking and non-blocking rng logic The blocking and non-blocking paths were failing to provide valid entropy due to improper buffer management. Reading the buffer starting from byte

• CVE-2026-74401CriAug 15, 2026
  affected >= 5.14.0, < 6.6.145fixed 6.6.145

  In the Linux kernel, the following vulnerability has been resolved: dlm: fix add msg handle in send_queue ordered In a benchmark scenario triggering a lot of requests that triggers a lot of DLM messages on the network it can be that the mh->seq is not ordered according the olde

• CVE-2026-74400Aug 15, 2026
  affected >= 6.15.0, < 6.18.40fixed 6.18.40

  In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries bpf_set_dentry_xattr and bpf_remove_dentry_xattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL.

• CVE-2026-74399Aug 15, 2026
  affected >= 4.18.0, < 5.15.212fixed 5.15.212

  In the Linux kernel, the following vulnerability has been resolved: evm: terminate and bound the evm_xattrs read buffer evm_read_xattrs() allocates size + 1 bytes, fills them from the list of enabled xattrs, and then passes strlen(temp) to simple_read_from_buffer(). When no con

• CVE-2026-74398CriAug 15, 2026
  affected >= 3.14.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD addrconf_dad_failure() transitions ifp->state from DAD to POSTDAD via addrconf_dad_end(), which drops ifp->lock on return. The lock is re

• CVE-2026-74397HigAug 15, 2026
  affected >= 4.5.0, < 6.6.145fixed 6.6.145

  In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5_ib_alloc_transport_domain() allocates a transport domain and then may fail in mlx5_ib_enable_lb(). In that case, the allocated TD is l

• CVE-2026-74396HigAug 15, 2026
  affected >= 6.16.0, < 6.18.40fixed 6.18.40

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure mlx5r_umr_update_xlt() allocates and DMA maps an XLT buffer with mlx5r_umr_create_xlt(). The buffer is released by the common cleanup path through mlx5r_um

• CVE-2026-74395Aug 15, 2026
  affected >= 5.3.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT() links event_sub into sub_list before initializing the fields used by the shared error path. If eventfd_ctx_fdge

• CVE-2026-74394CriAug 15, 2026
  affected >= 5.0.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check imm_buf->len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without overflow checking allows a malicious ini