CVE-2026-72224

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Free arenas on bttinit error paths The arenas allocated by discoverarenas or createarenas are not freed on some error paths in bttinit. This leaks memory when BTT initialization fails. Call freearenas from the affecte...

CVE-2026-72223

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Free arena sub-allocations on discoverarenas error path Memory allocated by bttfreelistinit, bttrttinit, and bttmaplocksinit is not freed on some discoverarenas error paths. This leaks memory when arena discovery fail...

UBUNTU-CVE-2026-72024

In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local-interfaces under RCU. The bulk hardware teardown path removes entries with listdel, so an asynchronous transmit completion can...

CVE-2026-72176

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: put stats for schemeadddirs internal error damonsysfsschemeadddirs setup the triedregions directory after the stats directory setup is completed. When the triedregions directory setup is failed, the setup...

CVE-2026-72272

In the Linux kernel, the following vulnerability has been resolved: fbdev: radeon: fix potential memory leak in radeonfbpciregister The function radeonfbpciregister allocates memory for modelist by calling radeoncheckmodes which calls fbaddvideomode. The memory is appended to info-modelist, but i...

CVE-2026-72267

In the Linux kernel, the following vulnerability has been resolved: fbdev: carminefb: fix potential memory leak in alloccarminefb The memory allocated for modelist in fbvideomodetomodelist is not freed in the subsequent error path. Fix that by calling fbdestroymodelist...

CVE-2026-72275

In the Linux kernel, the following vulnerability has been resolved: fbdev: broadsheetfb: fix potential memory leak in broadsheetfbprobe The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. Fix it by calling fbdeferrediocleanup...

CVE-2026-72184

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix hole runlist memory leak in insert range error path ntfsnonresidentattrinsertrange allocates holerl before mapping the whole runlist. If ntfsattrmapwholerunlist fails, the error path drops ni-runlist.lock and returns...

UBUNTU-CVE-2026-72274

In the Linux kernel, the following vulnerability has been resolved: fbdev: hecubafb: fix potential memory leak in hecubafbprobe The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. Fix it by calling fbdeferrediocleanup...

UBUNTU-CVE-2026-72040

In the Linux kernel, the following vulnerability has been resolved: ipmi: fix refcount leak in iipmirequest When a caller provides a suppliedrecv message to iipmirequest, the function increments the user's nrmsgs reference count. If an error occurs later, the outerr cleanup path only frees the...

UBUNTU-CVE-2026-72050

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Free BPID bitmap on setup failure nixsetupbpids allocates bp-bpids with rvuallocbitmap, which uses a plain kcalloc. If any of the following devmkcalloc allocations for the BPID mapping arrays fails, the function...

UBUNTU-CVE-2026-72017

In the Linux kernel, the following vulnerability has been resolved: net: macb: drop in-flight Tx SKBs on close The MACB driver has since forever leaked the outgoing SKBs that have not yet been marked as completed. They live in queue-txskb which gets freed without remorse nor checking...

UBUNTU-CVE-2026-72144

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-laptop: fix missing cleanups in init error path dellinit initializes several resources after dellsetuprfkill, including the optional touchpad LED, keyboard backlight LED, battery hook, debugfs directory and...

UBUNTU-CVE-2026-72142

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 atomic SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic polling path rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next receive cycle has...

CVE-2026-72008

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check Should probe fail for HWVOTER type power domains, this driver was unconditionally trying to perform cleanup for DIRECTCTL domains, but only after checking if the...

UBUNTU-CVE-2026-72008

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check Should probe fail for HWVOTER type power domains, this driver was unconditionally trying to perform cleanup for DIRECTCTL domains, but only after checking if the...

CVE-2026-68470

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

UBUNTU-CVE-2026-68463

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: use pmruntimeresumeandget in suspend Replace pmruntimegetsync with pmruntimeresumeandget to simplify error handling. pmruntimeresumeandget automatically drops the usage counter on failure, avoiding the need...

CVE-2026-74439

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry devicepasidtableteardown zeroes the 128-bit scalable-mode context entry with contextclearentry while the Present bit is still set. This creates a windo...

CVE-2026-74396

CVE-2026-74396 affects the Linux kernel in the RDMA/mlx5 stack. The issue occurs in the path that allocates and DMA maps an XLT buffer via mlx5r_umr_create_xlt() and releases it through mlx5r_umr_unmap_free_xlt(). If mlx5_odp_populate_xlt() encounters an error, its error path previously returned ...