CVE-2026-72369

In the Linux kernel, the following vulnerability has been resolved: minix: avoid overflow in bitmap block count calculation minixchecksuperblock uses minixblocksneeded to verify that the on-disk imap and zmap block counts are large enough for the advertised inode and zone counts. The helper...

CVE-2026-72366

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfscreatewritereq to handle async cache object creation netfscreatewritereq will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough...

CVE-2026-72370

In the Linux kernel, the following vulnerability has been resolved: iomap: release pages on atomic dio size mismatch If bioiovitergetpages or the bounce helper succeeds but builds a short bio, the REQATOMIC size check rejects it before submission. The old error path only dropped the bio reference...

CVE-2026-72368

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double unlock in nomemdalloc error path When startcreating fails and returns -ENOMEM, it has already released the parent directory lock in startdirop: static struct dentry startdirop... ... inodelocknesteddir,...

CVE-2026-72371

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFSVOLUMERMTREE is set on Fix afsinsertvolumeintocell to set AFSVOLUMERMTREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volume to be...

CVE-2026-72375

In the Linux kernel, the following vulnerability has been resolved: afs: Fix reinitialisation of the inode, in particular -lockwork It seems that initalising afsvnode::lockwork a single time in the slab's init function isn't sufficient for workstructs. This results in the DEBUGOBJECTS debugging...

CVE-2026-72372

In the Linux kernel, the following vulnerability has been resolved: afs: Fix lack of locking around modifications of net-cellsdynino Fix the lack of locking around modifications of net-cellsdynino by taking net-cellslock exclusively. This also requires to cell to be removed from net-cellsdynino i...

CVE-2026-72374

In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incomi...

CVE-2026-72373

In the Linux kernel, the following vulnerability has been resolved: afs: Fix missing NULL pointer check in afsbreaksomecallbacks Fix afsbreaksomecallbacks to check to see if afslookupvolumercu returned NULL e.g. the specified volume is unknown...

CVE-2026-72356

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifsissueread Fix missing release of credits in the failure path in cifsissueread lest retrying the subreq just overwrites the credits value...

CVE-2026-72357

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Use proper mmstruct in inuprobetrampoline In the unregister path we use inuprobetrampoline check with current-mm for the VMA lookup, which is wrong, because we are in the tracer context, not the traced process. Add...

CVE-2026-72364

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix writeback error handling Fix the error handling in writebackiter loop. If an error occurs, writebackiter needs to be called again with error set to the error so that it can clean up iteration state. Further, the curren...

CVE-2026-72363

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio state after ENOMEM whilst under writeback iteration Fix the state of the current folio when ENOMEM occurs during writeback iteration. The folio needs to be redirtied and unlocked before the terminal writebackiter...

CVE-2026-72365

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix writethrough to use collection offload Fix writethrough write to set NETFSRREQOFFLOADCOLLECTION on the request so that collection is processed asynchronously rather than only right at the end - and also so that...

CVE-2026-72358

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding, xeptstagebind explicitly skips initializing the xerescursor for purged BOs, treating them similarly to NULL VMAs by only setting the...

CVE-2026-72359

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bomeminfo When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle...

CVE-2026-72362

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Fix NULL pointer dereference in xeptzapptesentry The page-table walk framework may pass a NULL child pointer for unpopulated entries. xeptzapptesentry called containerofchild before checking for NULL, then dereferenced...

CVE-2026-72360

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Don't attempt to process FASTREQ or EVENT relays Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt to handle FASTREQUEST nor EVENT messages as this would result in...

CVE-2026-72361

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hwengine: Fix double-free of managed BO in error path The error path in hwengineinit explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup action...

CVE-2026-72350

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtu32: reject invalid shift counts u32matchit executes rule-supplied shift operands on a 32-bit value. A malformed u32 rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during...