EUVD-2026-58923

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix condition in 'nandselecttarget' 'cs' here must be in range 0:nanddevntargets...

CVE-2026-72162

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2sumrightmostrec BUG On-disk corruption setting lnextfreerec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. CAUSE...

CVE-2026-72162

CVE-2026-72162 — In the Linux kernel OCFS2 code, a UBSAN array-index-out-of-bounds flaw occurs in ocfs2_sum_rightmost_rec when l_next_free_rec is 0 or exceeds l_count, indexing l_recs[] out of bounds. The root cause is computing i = le16_to_cpu(el->l_next_free_rec) - 1 without validating i. Th...

CVE-2026-72162 ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2sumrightmostrec BUG On-disk corruption setting lnextfreerec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. CAUSE...

CVE-2026-72162 ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2sumrightmostrec BUG On-disk corruption setting lnextfreerec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. CAUSE...

EUVD-2026-58920

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2sumrightmostrec BUG On-disk corruption setting lnextfreerec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. CAUSE...

CVE-2026-72011 s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()

In the Linux kernel, the following vulnerability has been resolved: s390/diag: Add missing arrayindexnospec call to memtopgetpagecount 'level' is user space controlled and used to read from an array. Add the missing arrayindexnospec call to prevent speculative execution...

CVE-2026-72011

The CVE-2026-72011 issue concerns the Linux kernel on s390 where a read from an array used by a user-space controlled level could be exploited via speculative execution. The fix adds a missing array_index_nospec() call to memtop_get_page_count() to mitigate speculative access. Connected documents...

EUVD-2026-59110

In the Linux kernel, the following vulnerability has been resolved: s390/diag: Add missing arrayindexnospec call to memtopgetpagecount 'level' is user space controlled and used to read from an array. Add the missing arrayindexnospec call to prevent speculative execution...

CVE-2026-68478 memstick: ms_block: reject a card that reports too many blocks

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

CVE-2026-74466: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

PT-2026-72615

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the replace effective prog and purge effective progs functions incorrectly locate slots in the effective array when BPF F PREORDER programs are...

PT-2026-72350

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An array-index-out-of-bounds issue exists in the ocfs2 sum rightmost rec function. On-disk corruption that sets the l next free rec variable to 0 in an inode's embedded extent list can...

PT-2026-72424

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the hw perf event init function where the ev variable, which is controlled by userspace via event-attr.config, is used as an array index. Although bounds checking is...

PT-2026-72769

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ASOC amd acp-sdw-legacy component where the create sdw dailinks function iterates through soc dais until it finds an entry with the initialised flag cleared. Becau...

Linux Distros Unpatched Vulnerability : CVE-2026-72236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/perfcpumcf: Add missing arrayindexnospec to hwperfeventinit ev variable is userspace controlled via event-attr.config and used as an array index after boun...

Linux Kernel Security Vulnerabilities

Versions of the Linux kernel prior to 6.18.40 and 7.1.5 contain security vulnerabilities. These vulnerabilities stem from the ocfs2sumrightmostrec function, which fails to properly validate indices when accessing the embedded extension list. This can lead to out-of-array access, triggering UBSAN...

PT-2026-72200

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390/diag component where the memtop get page count function fails to use array index nospec. Because the level variable is controlled by user space and used to re...

Linux Distros Unpatched Vulnerability : CVE-2026-72162

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2sumrightmostrec BUG On-disk corruption setting lnextfreerec to 0 in an inode's embedded extent list triggers ...

PT-2026-72499

In the Linux kernel, the following vulnerability has been resolved: drm/xe: free madvise VMA array on L2 flush failure xe vm madvise ioctl allocates madvise range.vmas in get vmas. After get vmas succeeds with at least one VMA, error paths must go through free vmas so the array is released before...