kernel

Vulnerabilities (14,027)

• CVE-2026-74713Aug 22, 2026
  affected >= 5.7.0, < 7.1.9fixed 7.1.9

  In the Linux kernel, the following vulnerability has been resolved: vhost_iotlb: bound map allocation in add_range vhost_iotlb_add_range_ctx() only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOST_IOTLB_FLAG_RETIRE set. Non-

• CVE-2026-74712Aug 22, 2026
  affected >= 6.12.0, < 6.12.104fixed 6.12.104

  In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in create_direct_keys() We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core] Read of size 272 at addr 0000000176795

• CVE-2026-74711Aug 22, 2026
  affected >= 6.4.0, < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus) Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbus_notify(), the code unconditionally casts every attribute to a struct sensor_device_attribute: drivers

• CVE-2026-74710Aug 22, 2026
  affected >= 6.8.0, < 6.12.104fixed 6.12.104

  In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AF_XDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short meta

• CVE-2026-74709Aug 22, 2026
  affected >= 6.15.0, < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: xsk: clear metadata pointer when no timestamp is requested User space can change metadata flags after request processing. Rereading them during completion can therefore make the kernel write a timestamp that wa

• CVE-2026-74708Aug 22, 2026
  affected >= 6.15.0, < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata. Reject the request when the registered metadata area does not contain the complete field

• CVE-2026-74707Aug 22, 2026
  affected >= 6.15.0, < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can cha

• CVE-2026-74706Aug 22, 2026
  affected >= 6.19.0, < 7.1.9fixed 7.1.9

  In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocation of auxr_dev fails during auxiliary device setup, the error path calls auxiliary_device_uninit(), which eventually invokes bnge_aux_dev_rele

• CVE-2026-74705Aug 22, 2026
  affected >= 4.6.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation __skb_udp_tunnel_segment() gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head, the saved UDP hea

• CVE-2026-74704Aug 22, 2026
  affected >= 4.19.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter The sch_cake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code cont

• CVE-2026-74703Aug 22, 2026
  affected >= 6.15.0, < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Validate T10 PI scatterlist counts When T10 PI is negotiated, vhost-scsi splits protection bytes from the data iterator before mapping the request scatterlists. A malformed request can claim protect

• CVE-2026-74702Aug 22, 2026
  affected >= 6.15.0, < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhost_scsi_setup_vq_cmds() runs from VHOST_SCSI_SET_ENDPOINT and allocates each command's protection scatterlist array (prot_sgl) according to the acknowledged

• CVE-2026-74701Aug 22, 2026
  affected >= 4.10.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in key_extract() When a packet arrives on an ARPHRD_NONE device (e.g. TUN), ovs_flow_key_extract() trusts the user-provided skb->protocol field: if it is ETH_P_TEB,

• CVE-2026-74700Aug 22, 2026
  affected >= 5.1.0, < 6.6.152fixed 6.6.152

  In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tc_new_tfilter where a tcf_proto can be found and briefly refe

• CVE-2026-74699Aug 22, 2026
  affected >= 7.0.0, < 7.1.9fixed 7.1.9

  In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix memory leak in exec_queue_set_hang_replay_state() The q->replay_state is blindly overwritten, which can potentially leak memory that was previously allocated by vmemdup_user(). Return an error if q-

• CVE-2026-74698Aug 22, 2026
  affected >= 6.17.0, < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix BQL reset on SQ re-activation mlx5e_queue_start() deactivates and re-activates all channels but closes only the queue being restarted. mlx5e_activate_txqsq() then unconditionally calls netdev_tx_

• CVE-2026-74697Aug 22, 2026
  affected >= 5.4.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption EOP (End of frame padding) on the AGG ring may cause overlapping of zero padding at the end of one segment with the next segment's data. If R

• CVE-2026-74696Aug 22, 2026
  affected >= 5.14.0, < 5.15.216fixed 5.15.216

  In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO max_qlen accounting across reuseport migration A listener's TCP_FASTOPEN max_qlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only sh

• CVE-2026-74695Aug 22, 2026
  affected >= 4.18.0, < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() Incoming skbs passing through netfilter flowtable offload hooks (or XFRM offload path) might already carry a ref-counted dst_entry assi

• CVE-2026-74694Aug 22, 2026
  affected >= 4.20.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length ncsi_send_cmd_nl() takes the number of bytes to copy from the attacker-controlled ncsi_pkt_hdr.length field of the in-band packet header, while th