kernel

Vulnerabilities (14,027)

• CVE-2026-74273Aug 15, 2026
  affected >= 6.3.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: cxl/region: Block region delete during region creation Expand the range lock, rename it "regions_lock", to disable region deletion in the critical period between construct_region() and attach_target(), as well

• CVE-2026-74272Aug 15, 2026
  affected >= 6.0.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: cxl/region: Resolve region deletion races Sungwoo noticed that the sysfs trigger to delete a region may try to delete a region multiple times. It also has no exclusion relative to the kernel releasing the regio

• CVE-2026-74271Aug 15, 2026
  affected >= 3.10.0, < 6.1.178fixed 6.1.178

  In the Linux kernel, the following vulnerability has been resolved: power: supply: core: fix supplied_from allocations If dts property power-supplies has multiple values, then accessing to psy->supplied_from[i-1] in __power_supply_populate_supplied_from will overrun supplied_fr

• CVE-2026-74270HigAug 15, 2026
  affected >= 6.4.0, < 6.6.145fixed 6.6.145

  In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent (tlshd). ACCEPT already requires GEN

• CVE-2026-74269CriAug 15, 2026
  affected >= 6.5.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: bnxt: fix head underflow on XDP head-grow The xdp.py test test_xdp_native_adjst_head_grow_data crashes when run on a bnxt machine (and also crashes in NIPA). It seems that the bug is an underflow in bnxt_rx_mu

• CVE-2026-74268CriAug 15, 2026
  affected >= 4.16.0, < 6.18.40fixed 6.18.40

  In the Linux kernel, the following vulnerability has been resolved: tcp: clear sock_ops cb flags before force-closing a child socket A child socket inherits the listener's bpf_sock_ops_cb_flags via sk_clone_lock(). If its setup fails in tcp_v4_syn_recv_sock() / tcp_v6_syn_recv_

• CVE-2026-74267CriAug 15, 2026
  affected < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Whenever codel drops packets during peek, it calls qdisc_tree_reduce_backlog. An issue arises because it calls qdisc

• CVE-2026-74266Aug 15, 2026
  affected >= 6.17.0, < 6.18.40fixed 6.18.40

  In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_dualpi2: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Whenever dualpi2 drops packets during peek, it calls qdisc_tree_reduce_backlog. An issue arises because it calls q

• CVE-2026-74265Aug 15, 2026
  affected >= 5.13.0, < 5.15.212fixed 5.15.212

  In the Linux kernel, the following vulnerability has been resolved: net: mana: initialize gdma queue id to INVALID_QUEUE_ID mana_gd_create_mana_wq_cq() leaves queue->id as 0 (from kzalloc_obj()) until mana_create_wq_obj() assigns the firmware-returned id. If creation fails befo

• CVE-2026-74264HigAug 15, 2026
  affected >= 5.17.0, < 6.18.40fixed 6.18.40

  In the Linux kernel, the following vulnerability has been resolved: net: watchdog: fix refcount tracking races Blamed commit converted the untracked dev_hold()/dev_put() calls in the watchdog code to use the tracked dev_hold_track()/dev_put_track() (which were later renamed/int

• CVE-2026-74263Aug 15, 2026
  affected >= 6.4.0, < 6.6.145fixed 6.6.145

  In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: check skb_clone in control TX t7xx_port_ctrl_tx() clones each skb fragment before passing it to the port transmit path. The clone is used immediately to set cloned->len, so an skb_clone() failu

• CVE-2026-74262HigAug 15, 2026
  affected >= 4.6.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: kcm: use WRITE_ONCE() when changing lower socket callbacks kcm_attach() replaces a live lower TCP socket's sk_data_ready and sk_write_space callbacks with KCM handlers, and kcm_unattach() restores them later. T

• CVE-2026-74261Aug 15, 2026
  affected >= 4.11.0, < 6.18.40fixed 6.18.40

  In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: avoid stale FIFO cells during resize snd_seq_fifo_resize() still needs to publish the replacement pool before it waits for FIFO users. A blocking snd_seq_read() holds f->use_lock while it sleeps, so

• CVE-2026-74260HigAug 15, 2026
  affected >= 6.16.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them Update nft_dup and nft_fwd to use the nf_dev_xmit_recursion() helpers. This patch also disables BH when transmitting the skb to addres

• CVE-2026-74259HigAug 15, 2026
  affected < 6.1.178fixed 6.1.178

  In the Linux kernel, the following vulnerability has been resolved: cifs: remove all cifs files before kill super Cifs files may be put into fileinfo_put_wq during umounting cifs. After umount done, cifsFileInfo_put_final is called, which cause following BUG: BUG: kernel NULL

• CVE-2026-74258HigAug 15, 2026
  affected >= 6.6.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: bpf: Guard __get_user acesss with access_ok for uprobe_multi data As reported by sashiko [1] we need to use access_ok to check the user space data bounds before we use __get-user to get it. [1] https://lore.ke

• CVE-2026-74257HigAug 15, 2026
  affected >= 5.14.0, < 6.18.40fixed 6.18.40

  In the Linux kernel, the following vulnerability has been resolved: sockmap: Fix use-after-free in udp_bpf_recvmsg() syzbot reported use-after-free of struct sk_msg in sk_msg_recvmsg(). [0] sk_msg_recvmsg() peeks sk_msg from psock->ingress_msg under a lock, but its processing

• CVE-2026-74256HigAug 15, 2026
  affected >= 5.0.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check

• CVE-2026-74255CriAug 15, 2026
  affected >= 4.4.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in tipc_l2_send_msg() Syzbot reported a slab-use-after-free in ipvlan_hard_header() when called from tipc_l2_send_msg(). The root cause is that tipc_disable_l2_media() calls synchronize_net() whi

• CVE-2026-72502HigAug 15, 2026
  affected >= 4.8.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) When MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535). This is interpreted by TCP as mss_clamp, allowing the MSS to reach