CVE-2026-72318 cifs: validate DFS referral string offsets

In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets parsedfsreferrals validates that the response header and referral array fit in the received buffer, but each referral also contains string offsets supplied by the server. Those offsets a...

CVE-2026-72310

CVE-2026-72310 : In the Linux kernel SMB client, the passthrough ioctl bounds check for smb2_ioctl_query_info() uses 32-bit fields for OutputOffset and input_buffer_length. The code adds these values directly, allowing 32-bit wrap-around, which can let a malicious server craft a large OutputOffse...

CVE-2026-72309 tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path

In the Linux kernel, the following vulnerability has been resolved: tracing/remotes: Fix leak in traceremoteallocbuffer error path If page allocation fails in traceremoteallocbuffer, desc-nrcpus is not yet incremented for the current CPU. As a consequence, on error, half-allocated rbdesc will not...

CVE-2026-72309 tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path

In the Linux kernel, the following vulnerability has been resolved: tracing/remotes: Fix leak in traceremoteallocbuffer error path If page allocation fails in traceremoteallocbuffer, desc-nrcpus is not yet incremented for the current CPU. As a consequence, on error, half-allocated rbdesc will not...

EUVD-2026-59208

In the Linux kernel, the following vulnerability has been resolved: tracing/remotes: Fix leak in traceremoteallocbuffer error path If page allocation fails in traceremoteallocbuffer, desc-nrcpus is not yet incremented for the current CPU. As a consequence, on error, half-allocated rbdesc will not...

CVE-2026-72304 ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Fix TOCTOU in sofipc4bytesput In sofipc4bytesput, the copy size is derived from the old data-size in the buffer rather than the incoming new data's size field from ucontrol. If the new data has a differen...

CVE-2026-72304

CVE-2026-72304: Linux kernel ASoC SOF IPC4 control TOCTOU in sof_ipc4_bytes_put. The bug arose from copying data using the old data->size instead of the incoming sof_abi_hdr.size from ucontrol, which could copy stale bytes or truncate valid data when sizes differ. The connected sources confirm...

CVE-2026-72304 ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Fix TOCTOU in sofipc4bytesput In sofipc4bytesput, the copy size is derived from the old data-size in the buffer rather than the incoming new data's size field from ucontrol. If the new data has a differen...

CVE-2026-72302

The CVE-2026-72302 entry documents a Linux kernel flaw in ASoC: SOF ipc3-control where sof_ipc3_control_update() used firmware-provided cdata->num_elems in arithmetic that could overflow on 32-bit platforms. This overflow could let cdata->rhdr.hdr.size comparisons pass with mismatched sizes...

CVE-2026-72303 ASoC: SOF: ipc4-control: Validate notification payload size

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Validate notification payload size Validate MODULENOTIFICATION payload length before reading bytes/channel data in control update handling...

CVE-2026-72303

In the Linux kernel, the ASoC: SOF: ipc4-control vulnerability fixes validation of MODULE_NOTIFICATION payload length before reading bytes/channel data in control update handling. Root cause was insufficient payload size checks in the control update path, with CVSSv3.1 base score 7.8 (Local, Low ...

EUVD-2026-59202

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Validate notification payload size Validate MODULENOTIFICATION payload length before reading bytes/channel data in control update handling...

CVE-2026-72303 ASoC: SOF: ipc4-control: Validate notification payload size

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Validate notification payload size Validate MODULENOTIFICATION payload length before reading bytes/channel data in control update handling...

CVE-2026-72301 ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix TOCTOU in bytesput and bytesget In sofipc3bytesput, the size used for the memcpy is derived from the old data-size already in the buffer, not the incoming new data's size field. If the new data has a...

EUVD-2026-59199

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

CVE-2026-72300 ASoC: SOF: topology: validate vendor array size before parsing

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

CVE-2026-72300

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

CVE-2026-72300 ASoC: SOF: topology: validate vendor array size before parsing

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

CVE-2026-72298 net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtrendpointpost qrtrendpointpost validates an incoming packet with if !size || len != ALIGNsize, 4 + hdrlen goto err; where size comes from the wire. On 32-bit, sizet is 32 bits and...

EUVD-2026-59197

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtrendpointpost qrtrendpointpost validates an incoming packet with if !size || len != ALIGNsize, 4 + hdrlen goto err; where size comes from the wire. On 32-bit, sizet is 32 bits and...