CVE-2026-72310

CVE-2026-72310 : In the Linux kernel SMB client, the passthrough ioctl bounds check for smb2_ioctl_query_info() uses 32-bit fields for OutputOffset and input_buffer_length. The code adds these values directly, allowing 32-bit wrap-around, which can let a malicious server craft a large OutputOffse...

CVE-2026-72309 tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path

In the Linux kernel, the following vulnerability has been resolved: tracing/remotes: Fix leak in traceremoteallocbuffer error path If page allocation fails in traceremoteallocbuffer, desc-nrcpus is not yet incremented for the current CPU. As a consequence, on error, half-allocated rbdesc will not...

EUVD-2026-59208

In the Linux kernel, the following vulnerability has been resolved: tracing/remotes: Fix leak in traceremoteallocbuffer error path If page allocation fails in traceremoteallocbuffer, desc-nrcpus is not yet incremented for the current CPU. As a consequence, on error, half-allocated rbdesc will not...

CVE-2026-72309 tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path

In the Linux kernel, the following vulnerability has been resolved: tracing/remotes: Fix leak in traceremoteallocbuffer error path If page allocation fails in traceremoteallocbuffer, desc-nrcpus is not yet incremented for the current CPU. As a consequence, on error, half-allocated rbdesc will not...

CVE-2026-72304 ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Fix TOCTOU in sofipc4bytesput In sofipc4bytesput, the copy size is derived from the old data-size in the buffer rather than the incoming new data's size field from ucontrol. If the new data has a differen...

CVE-2026-72304

CVE-2026-72304: Linux kernel ASoC SOF IPC4 control TOCTOU in sof_ipc4_bytes_put. The bug arose from copying data using the old data->size instead of the incoming sof_abi_hdr.size from ucontrol, which could copy stale bytes or truncate valid data when sizes differ. The connected sources confirm...

CVE-2026-72304 ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Fix TOCTOU in sofipc4bytesput In sofipc4bytesput, the copy size is derived from the old data-size in the buffer rather than the incoming new data's size field from ucontrol. If the new data has a differen...

CVE-2026-72302

The CVE-2026-72302 entry documents a Linux kernel flaw in ASoC: SOF ipc3-control where sof_ipc3_control_update() used firmware-provided cdata->num_elems in arithmetic that could overflow on 32-bit platforms. This overflow could let cdata->rhdr.hdr.size comparisons pass with mismatched sizes...

CVE-2026-72303 ASoC: SOF: ipc4-control: Validate notification payload size

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Validate notification payload size Validate MODULENOTIFICATION payload length before reading bytes/channel data in control update handling...

CVE-2026-72303

In the Linux kernel, the ASoC: SOF: ipc4-control vulnerability fixes validation of MODULE_NOTIFICATION payload length before reading bytes/channel data in control update handling. Root cause was insufficient payload size checks in the control update path, with CVSSv3.1 base score 7.8 (Local, Low ...

CVE-2026-72303 ASoC: SOF: ipc4-control: Validate notification payload size

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Validate notification payload size Validate MODULENOTIFICATION payload length before reading bytes/channel data in control update handling...

EUVD-2026-59202

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Validate notification payload size Validate MODULENOTIFICATION payload length before reading bytes/channel data in control update handling...

CVE-2026-72301 ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix TOCTOU in bytesput and bytesget In sofipc3bytesput, the size used for the memcpy is derived from the old data-size already in the buffer, not the incoming new data's size field. If the new data has a...

EUVD-2026-59199

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

CVE-2026-72300 ASoC: SOF: topology: validate vendor array size before parsing

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

CVE-2026-72300

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

CVE-2026-72300 ASoC: SOF: topology: validate vendor array size before parsing

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

CVE-2026-72298 net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtrendpointpost qrtrendpointpost validates an incoming packet with if !size || len != ALIGNsize, 4 + hdrlen goto err; where size comes from the wire. On 32-bit, sizet is 32 bits and...

EUVD-2026-59197

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtrendpointpost qrtrendpointpost validates an incoming packet with if !size || len != ALIGNsize, 4 + hdrlen goto err; where size comes from the wire. On 32-bit, sizet is 32 bits and...

CVE-2026-72295 LoongArch: KVM: Validate irqchip index in irqfd routing

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate irqchip index in irqfd routing Sashiko reported that the irqchip index is not validated for LoongArch. Add validation and reject out-of-range irqchip indexes to avoid indexing past the routing table's chi...