kernel

Vulnerabilities (14,027)

• CVE-2026-74613Aug 22, 2026
  affected >= 5.3.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: avoid refilling the RX queue after teardown Commit b917507e5ad9 ("vsock/virtio: stop workers during the .remove()") made the RX worker jump to its common exit when rx_run is clear. That exit stil

• CVE-2026-74612Aug 22, 2026
  affected >= 5.18.0, < 6.1.184fixed 6.1.184

  In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdp_buff. If an XDP program adjusts the fragment area, veth_xdp_rcv_skb() copies xdp_frags_size back to

• CVE-2026-74611Aug 22, 2026
  affected >= 6.0.0, < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msg_iter before TLS 1.3 optimistic retry tls_decrypt_sg() advances msg->msg_iter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be u

• CVE-2026-74610Aug 22, 2026
  affected >= 6.5.0, < 6.6.152fixed 6.6.152

  In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext sk_msg ring unpushed When the copy path in tls_sw_sendmsg_locked() adds the fragment that fills the plaintext sk_msg ring, it does not set full_record, so the record is left fu

• CVE-2026-74609Aug 22, 2026
  affected >= 4.4.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: tipc: read le->link under the node lock in tipc_node_link_down() tipc_node_link_down() caches the link pointer before taking n->lock: struct tipc_link *l = le->link; /* unlocked */ if (!l) return; tipc_

• CVE-2026-74608Aug 22, 2026
  affected < 6.1.183fixed 6.1.183

  In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_try_adding_channels() cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that re

• CVE-2026-74607Aug 22, 2026
  affected >= 5.18.0, < 6.1.184fixed 6.1.184

  In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Interaction between KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM can cause two separate issues: - in sev_mi

• CVE-2026-74606Aug 22, 2026
  affected < 6.6.152fixed 6.6.152

  In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfs_remove_rec() eventfs_remove_rec() recursively removes the child at the current loop position. After the recursive call returns, list_for_each_entry() advances by reading l

• CVE-2026-74605Aug 22, 2026
  affected >= 6.8.0, < 7.1.9fixed 7.1.9

  In the Linux kernel, the following vulnerability has been resolved: eventfs: Use children field for rcu head and add memory barriers When an eventfs inode is freed, it sets ei->is_freed and then uses its ei->list to add it to the srcu link list as the list field is a union with

• CVE-2026-74604Aug 22, 2026
  affected < 5.15.216fixed 5.15.216

  In the Linux kernel, the following vulnerability has been resolved: Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Revert commit 030a48b0f6ce ("thermal/drivers/hwmon: Cleanup coding style a bit") that introduced a use-after-free into the error path of thermal_add_hw

• CVE-2026-74603Aug 22, 2026
  affected >= 5.18.0, < 6.1.183fixed 6.1.183

  In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: Fix board ID over-read The EEPROM board ID is a fixed 13-byte field and is not guaranteed to contain a NUL terminator. Passing it directly to devlink_info_version_fixed_put() treats it as a C string a

• CVE-2026-74602Aug 22, 2026
  affected >= 6.8.0, < 6.12.105fixed 6.12.105

  In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() In rb_allocate_cpu_buffer(), bpage->order was omitted, leaving it as 0. This is an issue for a ring-buffer with subbufs bigger than PAGE_SIZ

• CVE-2026-74601Aug 22, 2026
  affected >= 4.5.0, < 5.10.266fixed 5.10.266

  In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Use current_context for safe per-CPU buffer swap The ring_buffer_swap_cpu() function currently checks the per-CPU committing counter to determine if a buffer is actively being written to before per

• CVE-2026-74600Aug 22, 2026
  affected >= 5.17.0, < 6.18.46fixed 6.18.46

  In the Linux kernel, the following vulnerability has been resolved: mm/page_table_check: skip special zero mappings page_table_check_set() and page_table_check_clear() account mappings based on PageAnon(). Shared zero-page PTEs and huge zero PMDs are special mappings, but page

• CVE-2026-74599Aug 22, 2026
  affected >= 4.16.0, < 5.10.266fixed 5.10.266

  In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: always stabilise against page table freeing using init_mm Previous commits have established the invariant that kernel page table freeing is performed while an mmap read lock on init_mm is held, which

• CVE-2026-74598Aug 22, 2026
  affected >= 2.6.17, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6_route_rcv() validates the Route Information option (RFC 4191) length against the prefix length, but both checks are off by one. rinfo->length is the ND

• CVE-2026-74597Aug 22, 2026
  affected >= 2.6.22, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip6ip6_err() ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6_send(). The clone still carries the o

• CVE-2026-74596Aug 22, 2026
  affected >= 7.0.0, < 7.1.9fixed 7.1.9

  In the Linux kernel, the following vulnerability has been resolved: fs,fsverity: remove check for fsverity being enabled in setattr_prepare() The check that fs-verity is available in the kernel is not necessary here. Filesystems could have fsverity files even without fs-verity

• CVE-2026-74595Aug 22, 2026
  affected >= 5.12.0, < 5.15.217fixed 5.15.217

  In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() fscrypt_ioctl_set_policy() calls inode_owner_or_capable() with &nop_mnt_idmap before allowing an encryption policy to be set, inste

• CVE-2026-74594Aug 22, 2026
  affected < 5.10.266fixed 5.10.266

  In the Linux kernel, the following vulnerability has been resolved: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() psi_schedule_rtpoll_work() is called locklessly from the scheduler hotpath and can race psi_trigger_destroy() taking down the last rtpoll trigger under rtp