In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Initialise reader page order in rballocatecpu_buffer()
In rballocatecpubuffer(), bpage->order was omitted, leaving it as 0. This is an issue for a ring-buffer with subbufs bigger than PAGESIZE if when freed: freebufferpage() relies on this value. Align the value with the actual allocation size (buffer::subbuf_order).
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74602.json"
}