CVE-2026-72451 xfrm: Fix xfrm state cache insertion race

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrmstatelock. Thus it's possible for someone else to kill the state after it passed...

CVE-2026-72449 drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadata without removing it from the list. The list head is left pointing a...

CVE-2026-72450

The CVE-2026-72450 entry concerns a Linux kernel xfrm (IPsec) weakness where an AF_UNSPEC selector with large prefixlen could cause a shift-out-of-bounds in xfrm_selector_match() when matched against an IPv4 flow with XFRM_STATE_AF_UNSPEC set. The fixes implement: (1) rejecting mismatched familie...

CVE-2026-72449

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadata without removing it from the list. The list head is left pointing a...

CVE-2026-72449

CVE-2026-72449 : A Linux kernel flaw in drm/amdkfd causing list_del corruption during kfd_criu_resume_svm cleanup, leaving freed objects on the criu_svm_metadata_list. An unprivileged render-group user could trigger a use-after-free/double-free path via /dev/kfd. The fix adds list_del() before kf...

EUVD-2026-59348

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadata without removing it from the list. The list head is left pointing a...

EUVD-2026-59349

In the Linux kernel, the following vulnerability has been resolved: xfrm: validate selector family and prefixlen during match syzbot reported a shift-out-of-bounds in xfrmselectormatch due to AFUNSPEC selector with large prefixlen e.g. 128 matched against IPv4 flow when XFRMSTATEAFUNSPEC is set...

CVE-2026-72450 xfrm: validate selector family and prefixlen during match

In the Linux kernel, the following vulnerability has been resolved: xfrm: validate selector family and prefixlen during match syzbot reported a shift-out-of-bounds in xfrmselectormatch due to AFUNSPEC selector with large prefixlen e.g. 128 matched against IPv4 flow when XFRMSTATEAFUNSPEC is set...

CVE-2026-72450 xfrm: validate selector family and prefixlen during match

In the Linux kernel, the following vulnerability has been resolved: xfrm: validate selector family and prefixlen during match syzbot reported a shift-out-of-bounds in xfrmselectormatch due to AFUNSPEC selector with large prefixlen e.g. 128 matched against IPv4 flow when XFRMSTATEAFUNSPEC is set...

CVE-2026-72450

In the Linux kernel, the following vulnerability has been resolved: xfrm: validate selector family and prefixlen during match syzbot reported a shift-out-of-bounds in xfrmselectormatch due to AFUNSPEC selector with large prefixlen e.g. 128 matched against IPv4 flow when XFRMSTATEAFUNSPEC is set...

CVE-2026-72447

CVE-2026-72447 (Linux kernel SCTP diag leak) : The vulnerability concerns SCTP_DIAG endpoint dumping in the Linux kernel, where SCTP endpoint address lists were read without holding lock_sock(), allowing concurrent socket operations (e.g., bindx) to change data. This race can cause nla_reserve() ...

EUVD-2026-59346

In the Linux kernel, the following vulnerability has been resolved: sctp: hold socket lock when dumping endpoints in sctpdiag SCTPDIAG endpoint dumping was traversing endpoint address lists without holding locksock, while those lists could change concurrently via socket operations e.g., bindx...

CVE-2026-72447 sctp: hold socket lock when dumping endpoints in sctp_diag

In the Linux kernel, the following vulnerability has been resolved: sctp: hold socket lock when dumping endpoints in sctpdiag SCTPDIAG endpoint dumping was traversing endpoint address lists without holding locksock, while those lists could change concurrently via socket operations e.g., bindx...

CVE-2026-72448

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown The send-queue timestamp ring is allocated with qmemalloc when timestamping is used, but otx2freesqres never freed sq-timestamps, leaking that memory across ifdown and...

CVE-2026-72448 octeontx2-pf: Fix leak of SQ timestamp buffer on teardown

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown The send-queue timestamp ring is allocated with qmemalloc when timestamping is used, but otx2freesqres never freed sq-timestamps, leaking that memory across ifdown and...

CVE-2026-72447 sctp: hold socket lock when dumping endpoints in sctp_diag

In the Linux kernel, the following vulnerability has been resolved: sctp: hold socket lock when dumping endpoints in sctpdiag SCTPDIAG endpoint dumping was traversing endpoint address lists without holding locksock, while those lists could change concurrently via socket operations e.g., bindx...

CVE-2026-72447

In the Linux kernel, the following vulnerability has been resolved: sctp: hold socket lock when dumping endpoints in sctpdiag SCTPDIAG endpoint dumping was traversing endpoint address lists without holding locksock, while those lists could change concurrently via socket operations e.g., bindx...

CVE-2026-72446

CVE-2026-72446 affects the Linux kernel ALSA: usb-audio on Qualcomm, where disable requests could dereference a negative info_idx on the disable path in handle_uaudio_stream_req(), causing memory corruption (read/write) when a stream was never enabled or when the interface doesn’t match. The vuln...

CVE-2026-72446

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: reject stream disable with no active interface handleuaudiostreamreq resolves an interface index with infoidxfromifnum, which returns -EINVAL when no interface matches. The enable branch and the response:...

CVE-2026-72446 ALSA: usb-audio: qcom: reject stream disable with no active interface

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: reject stream disable with no active interface handleuaudiostreamreq resolves an interface index with infoidxfromifnum, which returns -EINVAL when no interface matches. The enable branch and the response:...