CVE-2026-72265

In the Linux kernel, the following vulnerability has been resolved: fbdev: nvidia: fix potential memory leak in nvidiafbprobe In nvidiafbprobe, the memory allocated for modelist in nvidiasetfbinfo is not freed in the subsequent error paths. Fix that by calling fbdestroymodelist...

CVE-2026-72224

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Free arenas on bttinit error paths The arenas allocated by discoverarenas or createarenas are not freed on some error paths in bttinit. This leaks memory when BTT initialization fails. Call freearenas from the affecte...

CVE-2026-72212

In the Linux kernel, the following vulnerability has been resolved: mm/memoryhotplug: fix incorrect altmap passing in error path In createaltmapsandmemoryblocks, when archaddmemory succeeds with memmaponmemory enabled, the vmemmap pages are allocated from params.altmap. If creatememoryblockdevice...

CVE-2026-72184

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix hole runlist memory leak in insert range error path ntfsnonresidentattrinsertrange allocates holerl before mapping the whole runlist. If ntfsattrmapwholerunlist fails, the error path drops ni-runlist.lock and returns...

CVE-2026-72177

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: fix dir put orders in accesspatternadddirs Patch series "mm/damon/sysfs-schemes: fix wrong directories put orders in error paths". Error paths of damonsysfsaccesspatternadddirs and damonsysfsschemeadddirs...

CVE-2026-72087

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfcsli4driverresourcesetup The memory allocated for mboxq using mempoolalloc is not freed in some of the early exit error paths. Fix that by moving the mempoolfree call to an earlier point after la...

CVE-2026-72081

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix I/O leak on unsupported additional CDB efctdispatchfcpcmd allocates an efctio before dispatching an unsolicited FCP command. If the command has an unsupported additional CDB, the function returns -EIO before...

CVE-2026-72026

In the Linux kernel, the following vulnerability has been resolved: irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure imsicearlyacpiinit allocates a firmware node before setting up the IMSIC state. If imsicsetupstate fails, the function returns without freeing the allocated...

CVE-2026-74386 nvmet-tcp: fix page fragment cache leak in error path

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmettcpallocqueue, when a connection is closed during the allocation process e.g., nvmettcpsetqueuesock returns -ENOTCONN, the error handling jumps to outdestroysq and the...

EUVD-2026-59533

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmettcpallocqueue, when a connection is closed during the allocation process e.g., nvmettcpsetqueuesock returns -ENOTCONN, the error handling jumps to outdestroysq and the...

CVE-2026-74374 md/raid1,raid10: fix error-path detection with md_cloned_bio()

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix error-path detection with mdclonedbio Detect the error path using mdclonedbio instead of relying on r1bio in raid1 or r10bio-readslot in raid10, which may be NULL or -1 after splitting and resubmitting a fail...

EUVD-2026-59515

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12kwifi7dprxhverifytkipmic In ath12kwifi7dprxhverifytkipmic, the call to ath12kdprxchecknwifihdrlenvalid may return false when the NWIFI header length is invalid, causing the function to abort...

CVE-2026-74367 wifi: ath12k: fix inconsistent arvif state in vdev_create error paths

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix inconsistent arvif state in vdevcreate error paths ath12kmacvdevcreate has three error path issues that leave arvif in an inconsistent state: 1. When ath12kwmivdevcreate fails, the function returns directly...

EUVD-2026-59514

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix inconsistent arvif state in vdevcreate error paths ath12kmacvdevcreate has three error path issues that leave arvif in an inconsistent state: 1. When ath12kwmivdevcreate fails, the function returns directly...

CVE-2026-74355 iommu/vt-d: Fix RB-tree corruption in probe error path

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix RB-tree corruption in probe error path The info-node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the devicerbtreeinsert call is skipped. If a subsequent probe step fails, the...

EUVD-2026-59473

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix resource leak in probe error path When pcimiomapregion or devmkmemdup fail, the code returns directly without cleaning up previously allocated resources: - mt76device allocated by mt76allocdevice - pci irq...

CVE-2026-74326 wifi: mt76: mt7921: fix resource leak in probe error path

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix resource leak in probe error path When pcimiomapregion or devmkmemdup fail, the code returns directly without cleaning up previously allocated resources: - mt76device allocated by mt76allocdevice - pci irq...

CVE-2026-74301 Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix URB leak in allocmtkintrurb error path When btmtkisopktpad fails, the previously allocated URB is not freed, leaking the urb structure. Add usbfreeurb before returning the error...

EUVD-2026-59448

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix URB leak in allocmtkintrurb error path When btmtkisopktpad fails, the previously allocated URB is not freed, leaking the urb structure. Add usbfreeurb before returning the error...

EUVD-2026-59445

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix FRMR set pinned push error path Add destruction of FRMR handles in case the push to the pool fails. This prevents resources leak in case pool page allocation fails...