Kernel CVEs and low-level patch traffic

The kernel announced several CVEs covering traffic classification, slab freeing, SCTP, and ALSA, alongside security patches for PE digest bounds and staged sysctl vector writes. Separate series advanced dynamic TDX guest quote buffers and a virtual swap layer, the latter drawing a syzbot KASAN report.

cls_u32 offshift validation

Linux CVE announce reported CVE-2026-74544, fixing shift-out-of-bounds undefined behavior in the cls_u32 classifier when handling offshift. The path is reachable by unprivileged users through namespaces. Container and multi-tenant hosts that expose net/sched controls should treat the validation as a priority stable fix.

PE section bounds in asymmetric keys

A patch to crypto asymmetric_keys bounds section data range checks inside pefile_digest_pe_contents. Signed PE images can supply data_addr or raw_data_size values that point outside the buffer and trigger an out-of-bounds read during digesting. Kernel paths that verify PE signatures need the range clamp to avoid reading past the mapped image.

Slab free-path recursion

CVE-2026-74576 fixes unbounded recursion in the slab free path caused by obj_exts allocation cycles across kmalloc cache sizes. The change introduces handling tied to a new kmalloc type so the free path cannot re-enter indefinitely. Allocator and memory-management readers should note the cycle break in free handling.

Dynamic TDX guest quote buffers

A v3 patch series for tdx-guest makes quote buffer size dynamic rather than fixed. The series drew discussion among KVM and Intel participants on attestation scoping, DICE, and migration uAPI shape. Confidential computing and live-migration work depends on how that uAPI settles.

SCTP transport_count overflow

CVE-2026-74469 covers a fix, already in backport form, for an SCTP peer transport_count u16 overflow. The overflow could enable an 8 MiB skb overrun via sock_diag. Network stack and socket diagnostic users should pick up the transport count guard.

Virtual swap space v3

The v3 Virtual Swap Space series (swap table edition) adds a virtual swap layer with swap tables and zswap or physical backends. Testing produced a syzbot KASAN null-ptr-deref report against the patches. MM developers tracking swap redesign need to account for that failure mode in review.

ALSA sequencer divide by zero

CVE-2026-74504 is a stable fix for division by zero in ALSA sequencer initialize_timer. An unprivileged user can trigger the oops while a lock is held. Audio and desktop kernel trees should carry the timer initialization guard.

Staged sysctl vector writes

A v2 sysctl series disallows partial updates of miss-formatted INT and ULONG sysctl vectors. Writes are staged so a parse or range error leaves the prior kernel value unchanged. Anyone driving multi-value sysctls from userspace gains consistent failure semantics instead of half-applied state.