EUVD-2026-59008

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Free BPID bitmap on setup failure nixsetupbpids allocates bp-bpids with rvuallocbitmap, which uses a plain kcalloc. If any of the following devmkcalloc allocations for the BPID mapping arrays fails, the function...

CVE-2026-72050 octeontx2-af: Free BPID bitmap on setup failure

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Free BPID bitmap on setup failure nixsetupbpids allocates bp-bpids with rvuallocbitmap, which uses a plain kcalloc. If any of the following devmkcalloc allocations for the BPID mapping arrays fails, the function...

CVE-2026-72048 ieee802154: ca8210: fix cas_ctl leak on spi_async failure

In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix casctl leak on spiasync failure ca8210spitransfer allocates casctl with kzallocobjGFPATOMIC and relies entirely on the SPI completion callback ca8210spitransfercomplete to free it. The spiasync API only...

CVE-2026-72048

Linux kernel: ieee802154 ca8210 driver leaks cas_ctl on spi_async failure due to kzalloc_obj(GFP_ATOMIC) allocation that is only freed in the completion callback. On submission failure, spi_async() does not queue a callback, leaving cas_ctl and embedded spi_message/spi_transfer orphaned. The leak...

CVE-2026-72040 ipmi: fix refcount leak in i_ipmi_request()

In the Linux kernel, the following vulnerability has been resolved: ipmi: fix refcount leak in iipmirequest When a caller provides a suppliedrecv message to iipmirequest, the function increments the user's nrmsgs reference count. If an error occurs later, the outerr cleanup path only frees the...

EUVD-2026-58997

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix potential memory leak in bnx2xallocmembp If the allocation of fpi.tpainfo fails, the error path will not free the struct bnx2xfastpath allocated earlier, as it is not linked to the bp structure yet. Fix that by linking...

EUVD-2026-58998

In the Linux kernel, the following vulnerability has been resolved: ipmi: fix refcount leak in iipmirequest When a caller provides a suppliedrecv message to iipmirequest, the function increments the user's nrmsgs reference count. If an error occurs later, the outerr cleanup path only frees the...

CVE-2026-72039

The CVE-2026-72039 entry concerns the Linux kernel bug in the bnx2x driver where a potential memory leak could occur during bnx2x_alloc_mem_bp() if fp[i].tpa_info allocation fails. The fix is to link the newly allocated struct bnx2x_fastpath immediately after allocation so it is freed on error pa...

EUVD-2026-58996

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: fix BAR resource leak on PF number failure If cn23xxgetpfnum fails, the function returns without unmapping either BAR. Unmap both BARs before returning from the error path. Found by manual code review...

CVE-2026-72038 net: liquidio: fix BAR resource leak on PF number failure

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: fix BAR resource leak on PF number failure If cn23xxgetpfnum fails, the function returns without unmapping either BAR. Unmap both BARs before returning from the error path. Found by manual code review...

CVE-2026-72026

The CVE-2026-72026 vulnerability is in the Linux kernel IRQ subsystem for riscv IMSIC early initialization. The issue: imsic_early_acpi_init() allocates a firmware node before IMSIC state setup; if imsic_setup_state() fails, the allocated fwnode is not freed. The fix adds cleanup on the error pat...

EUVD-2026-59116

In the Linux kernel, the following vulnerability has been resolved: net: macb: drop in-flight Tx SKBs on close The MACB driver has since forever leaked the outgoing SKBs that have not yet been marked as completed. They live in queue-txskb which gets freed without remorse nor checking...

CVE-2026-72015 fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list A pseudo-locked group's RMID is freed when it is created. On unmount rmdirallsub unconditionally frees all RMID of all groups, resulting in a double-free of t...

EUVD-2026-59107

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check Should probe fail for HWVOTER type power domains, this driver was unconditionally trying to perform cleanup for DIRECTCTL domains, but only after checking if the...

CVE-2026-68470 wifi: mac80211: validate extension-frame layout before RX

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

CVE-2026-68470

The CVE-2026-68470 vulnerability affects the Linux kernel’s wifi/mac80211 path. It occurs when validating extension-frame layout before RX, allowing extension subtypes beyond S1G beacons to reach regular-header RX processing and potentially read header addresses. The fix narrows RX routing to han...

CVE-2026-68463

CVE-2026-68463 affects the Linux kernel component mmc: sdhci-esdhc-imx . The vulnerability arises from suspend handling where code was changed to use pm_runtime_resume_and_get() instead of pm_runtime_get_sync() to simplify error handling. The new function automatically drops the usage counter on ...

CVE-2026-14484

The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attacker...

CVE-2026-14484

The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attacker...

EUVD-2026-58835

The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attacker...