CVE-2026-72272

In the Linux kernel, the following vulnerability has been resolved: fbdev: radeon: fix potential memory leak in radeonfbpciregister The function radeonfbpciregister allocates memory for modelist by calling radeoncheckmodes which calls fbaddvideomode. The memory is appended to info-modelist, but i...

UBUNTU-CVE-2026-72040

In the Linux kernel, the following vulnerability has been resolved: ipmi: fix refcount leak in iipmirequest When a caller provides a suppliedrecv message to iipmirequest, the function increments the user's nrmsgs reference count. If an error occurs later, the outerr cleanup path only frees the...

CVE-2026-72177

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: fix dir put orders in accesspatternadddirs Patch series "mm/damon/sysfs-schemes: fix wrong directories put orders in error paths". Error paths of damonsysfsaccesspatternadddirs and damonsysfsschemeadddirs...

CVE-2026-72275

In the Linux kernel, the following vulnerability has been resolved: fbdev: broadsheetfb: fix potential memory leak in broadsheetfbprobe The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. Fix it by calling fbdeferrediocleanup...

CVE-2026-72184

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix hole runlist memory leak in insert range error path ntfsnonresidentattrinsertrange allocates holerl before mapping the whole runlist. If ntfsattrmapwholerunlist fails, the error path drops ni-runlist.lock and returns...

CVE-2026-72008

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check Should probe fail for HWVOTER type power domains, this driver was unconditionally trying to perform cleanup for DIRECTCTL domains, but only after checking if the...

UBUNTU-CVE-2026-72008

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check Should probe fail for HWVOTER type power domains, this driver was unconditionally trying to perform cleanup for DIRECTCTL domains, but only after checking if the...

CVE-2026-68470

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

UBUNTU-CVE-2026-68463

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: use pmruntimeresumeandget in suspend Replace pmruntimegetsync with pmruntimeresumeandget to simplify error handling. pmruntimeresumeandget automatically drops the usage counter on failure, avoiding the need...

CVE-2026-74439

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry devicepasidtableteardown zeroes the 128-bit scalable-mode context entry with contextclearentry while the Present bit is still set. This creates a windo...

EUVD-2026-59543

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure mlx5rumrupdatexlt allocates and DMA maps an XLT buffer with mlx5rumrcreatexlt. The buffer is released by the common cleanup path through mlx5rumrunmapfreexlt. After...

CVE-2026-74396

CVE-2026-74396 affects the Linux kernel in the RDMA/mlx5 stack. The issue occurs in the path that allocates and DMA maps an XLT buffer via mlx5r_umr_create_xlt() and releases it through mlx5r_umr_unmap_free_xlt(). If mlx5_odp_populate_xlt() encounters an error, its error path previously returned ...

CVE-2026-74395 RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5IBMETHODDEVXSUBSCRIBEEVENT links eventsub into sublist before initializing the fields used by the shared error path. If eventfdctxfdget then fails, the unwind path...

EUVD-2026-59542

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5IBMETHODDEVXSUBSCRIBEEVENT links eventsub into sublist before initializing the fields used by the shared error path. If eventfdctxfdget then fails, the unwind path...

CVE-2026-74395 RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5IBMETHODDEVXSUBSCRIBEEVENT links eventsub into sublist before initializing the fields used by the shared error path. If eventfdctxfdget then fails, the unwind path...

CVE-2026-74387 ALSA: seq: midi: Serialize output teardown with event_input

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...

CVE-2026-74386 nvmet-tcp: fix page fragment cache leak in error path

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmettcpallocqueue, when a connection is closed during the allocation process e.g., nvmettcpsetqueuesock returns -ENOTCONN, the error handling jumps to outdestroysq and the...

CVE-2026-74386 nvmet-tcp: fix page fragment cache leak in error path

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmettcpallocqueue, when a connection is closed during the allocation process e.g., nvmettcpsetqueuesock returns -ENOTCONN, the error handling jumps to outdestroysq and the...

EUVD-2026-59533

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmettcpallocqueue, when a connection is closed during the allocation process e.g., nvmettcpsetqueuesock returns -ENOTCONN, the error handling jumps to outdestroysq and the...

CVE-2026-74386

CVE-2026-74386 affects the Linux kernel nvmet-tcp component. The root cause is a page fragment cache leak in the error path of nvmet_tcp_alloc_queue(): if a connection closes during allocation (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN), error handling jumps to out_destroy_sq and then ou...