CVE-2026-72261 ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in sndsofupdatecontrol In sndsofupdatecontrol, firmware-provided cdata-numelems is checked against localcdata-data-size but never against the actual allocation size. If localcdata-data-size...

CVE-2026-72261 ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in sndsofupdatecontrol In sndsofupdatecontrol, firmware-provided cdata-numelems is checked against localcdata-data-size but never against the actual allocation size. If localcdata-data-size...

CVE-2026-72262 ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

CVE-2026-72262 ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

CVE-2026-72261

Summary: CVE-2026-72261 affects the Linux kernel ASoC: SOF ipc3-control path. In snd_sof_update_control, the code validates firmware-provided cdata->num_elems against local_cdata->data->size but does not verify it against the actual allocation size. If local_cdata->data->size was p...

EUVD-2026-59156

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm: fix NULL pointer dereference in graphcallback When q6apmfreefragments is called it frees rxdata.buf/txdata.buf and sets them to NULL under graph-lock. A late DSP buffer-done response can race with this:...

CVE-2026-72244

CVE-2026-72244 concerns the Linux kernel gpu/buddy allocator. The bug in try_harder contiguous fallback could return a range whose start offset didn’t match the caller’s min_block_size. The fix realigns misaligned candidates by freeing the misaligned run and reallocating exactly @size at the next...

EUVD-2026-59140

In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr on it might result in a buffer overread. The same thing will happen when said string is use...

CVE-2026-72241 leds: uleds: Fix potential buffer overread

In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr on it might result in a buffer overread. The same thing will happen when said string is use...

CVE-2026-72241

CVE-2026-72241 affects the Linux kernel’s leds: uleds path. The vulnerability arises because a user-supplied name string used by the LED class device may not be null-terminated, and using strchr() can lead to a buffer overread. The fix replaces strchr() with a safe variant (strnchr()) and adds an...

CVE-2026-72241 leds: uleds: Fix potential buffer overread

In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr on it might result in a buffer overread. The same thing will happen when said string is use...

CVE-2026-72232

CVE-2026-72232 relates to the Linux kernel/batman-adv stack, where a local user with eBPF TC hook access could trigger a packet truncation that redirects to a batman-adv interface. The vulnerability arises because the code assumes at least ETH_HLEN bytes are available and may read beyond the buff...

CVE-2026-72232 batman-adv: ensure minimal ethernet header on TX

In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 "net: bridge: xmit: make sure we have at least eth header len bytes", it is possible by for a local user with eBPF TC hook access to attach a t...

CVE-2026-72231 batman-adv: tt: avoid request storms during pending request

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: avoid request storms during pending request batadvsendttrequest allocates a ttreqnode when none exists for the destination originator node. This should prevent that a multiple TT requests are send at the same time...

CVE-2026-72231 batman-adv: tt: avoid request storms during pending request

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: avoid request storms during pending request batadvsendttrequest allocates a ttreqnode when none exists for the destination originator node. This should prevent that a multiple TT requests are send at the same time...

CVE-2026-72232 batman-adv: ensure minimal ethernet header on TX

In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 "net: bridge: xmit: make sure we have at least eth header len bytes", it is possible by for a local user with eBPF TC hook access to attach a t...

CVE-2026-72226 batman-adv: tt: prevent TVLV OOB check overflow

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadvtvlvttvlandata 8 bytes. The size can therefore...

CVE-2026-72226 batman-adv: tt: prevent TVLV OOB check overflow

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadvtvlvttvlandata 8 bytes. The size can therefore...

EUVD-2026-59125

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadvtvlvttvlandata 8 bytes. The size can therefore...

CVE-2026-72226

CVE-2026-72226 concerns the Linux kernel’s batman-adv TT TVLV handling. A unicast TVLV contains the number of VLANs (u16) and multiplies it by 8 (batadv_tvlv_tt_vlan_data). This can overflow the 16-bit tt_vlan_len, invalidating safety checks for out-of-bounds access. The published fix switches to...