CVE-2026-72491 net/9p: fix race condition on rdma->state in trans_rdma.c

In the Linux kernel, the following vulnerability has been resolved: net/9p: fix race condition on rdma-state in transrdma.c The rdma-state field is modified without holding reqlock in both recvdone and p9cmeventhandler, while rdmarequest accesses the same field under the reqlock spinlock. This...

CVE-2026-72474 dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor For architectures like Microblaze or arm64 where this IP is used, DMADIRECTREMAP is set which means that dmaalloccoherent might remap and hence vmalloc some memory...

EUVD-2026-59373

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor For architectures like Microblaze or arm64 where this IP is used, DMADIRECTREMAP is set which means that dmaalloccoherent might remap and hence vmalloc some memory...

CVE-2026-72474

Summary (concrete details available) : CVE-2026-72474 concerns the Linux kernel’s dmaengine, specifically the dma-axi-dmac path. The issue arises on architectures such as Microblaze or arm64 where DMA_DIRECT_REMAP can cause dma_alloc_coherent() to remap memory (including vmalloc()). In the affect...

CVE-2026-72461 apparmor: fix refcount leak when updating the sk_ctx

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the skctx Currently updateskctx transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller conditionally put the referenc...

CVE-2026-72424 rtc: msc313: fix NULL deref in shared IRQ handler at probe

In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313rtcprobe calls devmrequestirq with IRQFSHARED and &pdev-dev as the cookie, but platformsetdrvdata is only called later after the clock setup. With a shared IRQ line...

CVE-2026-72424

CVE-2026-72424 concerns the Linux kernel RTC MSC313 driver. The vulnerability arises when msc313_rtc_probe() calls devm_request_irq() with IRQF_SHARED and the cookie set to &pdev->dev, while platform_set_drvdata() runs later after clock setup. Under a shared IRQ line, another device can fire t...

CVE-2026-72388

The CVE-2026-72388 entry concerns the Linux kernel DRM/Panthor driver. Root cause: when acquiring the dma_fence lock, drivers can be reached from hardirq context, requiring the IRQ-safe variant and a guard-model switch. Affected component is drm/panthor in the kernel’s fence handling; fix involve...

EUVD-2026-59287

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock Since dmafence objects can be shared with other subsystems, they may be accessed from hardirq context in those drivers, and we have to take that into...

CVE-2026-72388 drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock Since dmafence objects can be shared with other subsystems, they may be accessed from hardirq context in those drivers, and we have to take that into...

CVE-2026-72388 drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock Since dmafence objects can be shared with other subsystems, they may be accessed from hardirq context in those drivers, and we have to take that into...

CVE-2026-72372 afs: Fix lack of locking around modifications of net->cells_dyn_ino

In the Linux kernel, the following vulnerability has been resolved: afs: Fix lack of locking around modifications of net-cellsdynino Fix the lack of locking around modifications of net-cellsdynino by taking net-cellslock exclusively. This also requires to cell to be removed from net-cellsdynino i...

EUVD-2026-59256

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Use proper mmstruct in inuprobetrampoline In the unregister path we use inuprobetrampoline check with current-mm for the VMA lookup, which is wrong, because we are in the tracer context, not the traced process. Add...

CVE-2026-72357 uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Use proper mmstruct in inuprobetrampoline In the unregister path we use inuprobetrampoline check with current-mm for the VMA lookup, which is wrong, because we are in the tracer context, not the traced process. Add...

CVE-2026-72357

The CVE-2026-72357 issue affects the Linux kernel’s uprobes/x86 path. The root cause is using current->mm for VMA lookup in __in_uprobe_trampoline during tracer context, which is incorrect for the traced process. The fix adds an mm_struct pointer argument to __in_uprobe_trampoline and updates ...

CVE-2026-72357 uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Use proper mmstruct in inuprobetrampoline In the unregister path we use inuprobetrampoline check with current-mm for the VMA lookup, which is wrong, because we are in the tracer context, not the traced process. Add...

CVE-2026-72332 accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo()

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Prevent PM resume deadlock in hwctxsyncdebugbo amdxdnahwctxsyncdebugbo invokes the hardware hwctxsyncdebugbo callback while holding xdna-devlock. The callback may call amdxdnacmdsubmit, which in turn calls...

CVE-2026-72185 ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix WARNON for resident attribute in ntfsmaprunlistnolock When ntfsmaprunlistnolock needs to look up the attribute extent containing a target VCN ctxneedsreset == true, it calls ntfsattrlookup and then expects the result to...

EUVD-2026-59048

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

CVE-2026-72090 accel/amdxdna: Use caller client for debug BO sync

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...