CVE-2026-72406

CVE-2026-72406 relates to the Linux kernel sungem driver. The issue occurred during probe error handling: gem_init_one() could call gem_remove_one() on register_netdev() failure and then fall through to cleanup, potentially freeing the same resources twice (DMA block, MMIO, PCI regions, net_devic...

EUVD-2026-59305

In the Linux kernel, the following vulnerability has been resolved: net: sungem: fix probe error cleanup geminitone calls gemremoveone when registernetdev fails. gemremoveone unregisters and frees resources owned by the netdevice, including the DMA block, MMIO mapping, PCI regions, and the...

CVE-2026-72406 net: sungem: fix probe error cleanup

In the Linux kernel, the following vulnerability has been resolved: net: sungem: fix probe error cleanup geminitone calls gemremoveone when registernetdev fails. gemremoveone unregisters and frees resources owned by the netdevice, including the DMA block, MMIO mapping, PCI regions, and the...

EUVD-2026-59279

In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response reqid before indexing rsp pvcallsfronteventhandler takes reqid directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a store, wi...

EUVD-2026-59277

In the Linux kernel, the following vulnerability has been resolved: afs: Fix error code in afsextractvladdrs The error codes on these paths are only set on the first iteration through the loop. Set the correct error code on every iteration...

CVE-2026-72378 afs: Fix error code in afs_extract_vl_addrs()

In the Linux kernel, the following vulnerability has been resolved: afs: Fix error code in afsextractvladdrs The error codes on these paths are only set on the first iteration through the loop. Set the correct error code on every iteration...

CVE-2026-72378

The CVE-2026-72378 entry concerns the Linux kernel, specifically the afs_extract_vl_addrs() path. The underlying issue is that error codes were only set on the first iteration of a loop; the patch fixes this by ensuring the correct error code is assigned on every iteration. This affects the AFS c...

CVE-2026-72378 afs: Fix error code in afs_extract_vl_addrs()

In the Linux kernel, the following vulnerability has been resolved: afs: Fix error code in afsextractvladdrs The error codes on these paths are only set on the first iteration through the loop. Set the correct error code on every iteration...

EUVD-2026-59275

In the Linux kernel, the following vulnerability has been resolved: afs: Fix misplaced inc of net-cellsoutstanding Fix net-cellsoutstanding being incremented before the check for failure of idralloccyclic, leaving the count incremented on error...

EUVD-2026-59273

In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incomi...

CVE-2026-72368

In the Linux kernel, CVE-2026-72368 describes a double unlock in the nomem_d_alloc path of cachefiles: after start_creating() fails with -ENOMEM, __start_dirop() releases the parent lock, but nomem_d_alloc in cachefiles_get_directory() unconditionally unlocks d_inode(dir) again, corrupting the rw...

EUVD-2026-59267

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double unlock in nomemdalloc error path When startcreating fails and returns -ENOMEM, it has already released the parent directory lock in startdirop: static struct dentry startdirop... ... inodelocknesteddir,...

CVE-2026-72368 cachefiles: Fix double unlock in nomem_d_alloc error path

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double unlock in nomemdalloc error path When startcreating fails and returns -ENOMEM, it has already released the parent directory lock in startdirop: static struct dentry startdirop... ... inodelocknesteddir,...

CVE-2026-72368 cachefiles: Fix double unlock in nomem_d_alloc error path

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double unlock in nomemdalloc error path When startcreating fails and returns -ENOMEM, it has already released the parent directory lock in startdirop: static struct dentry startdirop... ... inodelocknesteddir,...

EUVD-2026-59263

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix writeback error handling Fix the error handling in writebackiter loop. If an error occurs, writebackiter needs to be called again with error set to the error so that it can clean up iteration state. Further, the curren...

CVE-2026-72364 netfs: Fix writeback error handling

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix writeback error handling Fix the error handling in writebackiter loop. If an error occurs, writebackiter needs to be called again with error set to the error so that it can clean up iteration state. Further, the curren...

CVE-2026-72364

The CVE-2026-72364 pertains to the Linux kernel netfs writeback path. Affected component: writeback_iter() in netfs. Root cause: error handling in the writeback loop did not properly unwind state after an error. As documented, when an error occurs, writeback_iter() must be called again with the e...

CVE-2026-72364 netfs: Fix writeback error handling

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix writeback error handling Fix the error handling in writebackiter loop. If an error occurs, writebackiter needs to be called again with error set to the error so that it can clean up iteration state. Further, the curren...

CVE-2026-72360

The CVE-2026-72360 entry concerns the Linux kernel, specifically the DRM XE PCIe PF path. The vulnerability arises from PF relay logic attempting to process FAST_REQ or EVENT relays; VF/PF relay actions were defined only for regular REQUEST messages. This misbehavior could break the VFPF ABI prot...

EUVD-2026-59260

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hwengine: Fix double-free of managed BO in error path The error path in hwengineinit explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup action...