CVE-2026-72142 i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 atomic SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic polling path rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next receive cycle has...

CVE-2026-72140

CVE-2026-72140 relates to the Linux kernel, specifically the i2c mlxbf subsystem. The vulnerability arises in mlxbf_i2c_init_resource() when devm_platform_get_and_ioremap_resource() returns an error: tmp_res is freed before tmp_res->io is read to obtain the error code, causing a use-after-free...

CVE-2026-72140 i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()

In the Linux kernel, the following vulnerability has been resolved: i2c: mlxbf: Fix use-after-free in mlxbfi2cinitresource If devmplatformgetandioremapresource returns an error, mlxbfi2cinitresource frees tmpres before reading tmpres-io to get the error code. This results in a use-after-free. Sav...

CVE-2026-72138

The CVE describes a Linux kernel issue in xen/gntdev where gntdev_ioctl_map_grant_ref() could leak memory if copy_to_user() failed after adding a mapping and not releasing the acquired reference. The root cause involves mismanaged error paths: on failure to copy operation results back to userspac...

CVE-2026-72138 xen/gntdev: fix error handling in ioctl

In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: fix error handling in ioctl When gntdevioctlmapgrantref fails to copy the operation result back to userspace after successfully adding the mapping to the list, the error path returns -EFAULT without releasing the...

CVE-2026-72138 xen/gntdev: fix error handling in ioctl

In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: fix error handling in ioctl When gntdevioctlmapgrantref fails to copy the operation result back to userspace after successfully adding the mapping to the list, the error path returns -EFAULT without releasing the...

CVE-2026-72137 xfrm: nat_keepalive: avoid double free on send error

In the Linux kernel, the following vulnerability has been resolved: xfrm: natkeepalive: avoid double free on send error natkeepalivesend frees the keepalive skb whenever the IPv4 or IPv6 send helper reports an error. That cleanup is only correct before the skb is handed to the output path. Once...

CVE-2026-72137 xfrm: nat_keepalive: avoid double free on send error

In the Linux kernel, the following vulnerability has been resolved: xfrm: natkeepalive: avoid double free on send error natkeepalivesend frees the keepalive skb whenever the IPv4 or IPv6 send helper reports an error. That cleanup is only correct before the skb is handed to the output path. Once...

CVE-2026-72128

CVE-2026-72128 affects the Linux kernel nvmet subsystem. In nvmet_sq_create(), a reference on the ctrl is taken via kref_get_unless_zero() before nvmet_check_sqid(). If nvmet_check_sqid() fails, the function returns an error without releasing the reference, causing a refcount leak. The fix jumps ...

EUVD-2026-58886

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix refcount leak in nvmetsqcreate In nvmetsqcreate, a reference on the ctrl is taken via krefgetunlesszero before calling nvmetchecksqid. If nvmetchecksqid fails, the function returns the error directly without releasing...

EUVD-2026-59067

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: unregister blocking notifier on init failure sparx5registernotifierblocks registers the switchdev blocking notifier before allocating the ordered workqueue. If the workqueue allocation fails, the error path unregiste...

CVE-2026-72109 net: sparx5: unregister blocking notifier on init failure

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: unregister blocking notifier on init failure sparx5registernotifierblocks registers the switchdev blocking notifier before allocating the ordered workqueue. If the workqueue allocation fails, the error path unregiste...

CVE-2026-72109 net: sparx5: unregister blocking notifier on init failure

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: unregister blocking notifier on init failure sparx5registernotifierblocks registers the switchdev blocking notifier before allocating the ordered workqueue. If the workqueue allocation fails, the error path unregiste...

EUVD-2026-59057

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: don't increment hashoffset twice hashoffset is already incremented in the loop "for i = 0; i tocopy; i++, ts--". Do not increment it again...

CVE-2026-72096

CVE-2026-72096 affects the Linux kernel’s dm-verity component, where the error counter v->corrupted_errs was not atomic, potentially causing race conditions. This could allow the call to dm_audit_log_target("max-corrupted-errors") to be skipped due to races. The issue has been resolved in the ...

CVE-2026-72093 accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap()

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix use-after-free in amdxdnagemdmabufmmap When vminsertpages fails, the error path calls vma-vmops-closevma which internally calls drmgemvmclose → drmgemobjectput, releasing the GEM object reference acquired at th...

CVE-2026-72087

CVE-2026-72087 affects the Linux kernel SCSI LPFC driver, specifically the lpfc_sli4_driver_resource_setup() path. The vulnerability is a memory leak: memory allocated for mboxq via mempool_alloc() is not freed in some early exit error paths. The cited fixes relocate mempool_free() to an earlier ...

EUVD-2026-59045

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfcsli4driverresourcesetup The memory allocated for mboxq using mempoolalloc is not freed in some of the early exit error paths. Fix that by moving the mempoolfree call to an earlier point after la...

CVE-2026-72087 scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfcsli4driverresourcesetup The memory allocated for mboxq using mempoolalloc is not freed in some of the early exit error paths. Fix that by moving the mempoolfree call to an earlier point after la...

EUVD-2026-59040

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix refcount leak in efcthwioabort When efcthwreqtagalloc fails in efcthwioabort, the error path returns -ENOSPC without releasing the reference obtained via krefgetunlesszero earlier in the function. All other...