CVE-2026-72500 RDMA/bnxt_re: Free SRQ toggle page after firmware teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free SRQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroysrq won't write the toggle values to an already-freed...

CVE-2026-72499 RDMA/bnxt_re: Free CQ toggle page after firmware teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroycq won't write the toggle value to an already-freed page...

CVE-2026-72499 RDMA/bnxt_re: Free CQ toggle page after firmware teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroycq won't write the toggle value to an already-freed page...

CVE-2026-72496

CVE-2026-72496 affects the Linux kernel RDMA/bnxt_re path. The root cause is in bnxt_qplib_alloc_dpi returning success when ioremap fails; the fix adds proper rollback on ioremap failure and returns -ENOMEM. The published metrics indicate a CRITICAL base score (CVSS 3.1: AV:L/AC:L/PR:N/UI:N/S:C/C...

CVE-2026-72492

The CVE-2026-72492 issue concerns ksmbd (Linux kernel) where same_client_has_lease() returns an opinfo pointer from ci->m_op_list after dropping ci->m_lock without holding a reference. smb_grant_oplock() later dereferences this pointer in copy_lease() and while checking breaking_cnt, riskin...

CVE-2026-72486 mailbox: mtk-adsp: fix UAF during device teardown

In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...

CVE-2026-72486

The CVE-2026-72486 entry concerns the Linux kernel mailbox for the mtk-adsp (SOF audio) where a use-after-free (UAF) can occur during device teardown. When the SOF driver fails to initialize (e.g., firmware boot timeout), devres unwinds and frees snd_sof_dev, while the mtk_adsp_mailbox shutdown c...

CVE-2026-72485

CVE-2026-72485 describes a Linux kernel vulnerability in the coresight platform where nr_outconns/nr_inconns were incremented before allocations, causing a premature counter bump and potential panics during cleanup when allocations failed. The issue affects the coresight_add_out_conn() and coresi...

CVE-2026-72486 mailbox: mtk-adsp: fix UAF during device teardown

In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...

CVE-2026-72485

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...

CVE-2026-72480 iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling amseventtochannel may return a pointer past the end of dev-channels when no matching scanindex is found. This can lead to invalid memory access in...

CVE-2026-72480 iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling amseventtochannel may return a pointer past the end of dev-channels when no matching scanindex is found. This can lead to invalid memory access in...

EUVD-2026-59379

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling amseventtochannel may return a pointer past the end of dev-channels when no matching scanindex is found. This can lead to invalid memory access in...

CVE-2026-72479 iio: accel: mma8452: handle I2C read error(s) in mma8452_read()

In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: handle I2C read errors in mma8452read Currently, If i2csmbusreadi2cblockdata fails but mma8452setruntimepmstate succeeds, mma8452read returns 0. As a result, the caller mma8452readraw assumes the read was...

CVE-2026-72480

CVE-2026-72480 : In the Linux kernel, the iio: adc: xilinx-ams component had an out-of-bounds channel lookup in event handling. The function ams_event_to_channel() could return a pointer past the end of dev->channels when no matching scan_index was found, risking invalid memory access in ams_h...

CVE-2026-72477

The CVE-2026-72477 entry concerns the Linux kernel (fs/ntfs3) where a failure to rename could trigger an inconsistent inode state. The root issue was a WARN_ON path; it has been replaced with a call to _ntfs_bad_inode(), preventing further operations on the affected inode. This change appears to ...

EUVD-2026-59374

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: Properly free struct axidmacdesc Use axidmacfreedesc to free fully the descriptor at fail path when call axidmacallocdesc in axidmacprepperipheraldmavec...

EUVD-2026-59366

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwrwpcreate during connect frwrwpcreate creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave...

CVE-2026-72465 xprtrdma: Sanitize the reply credit grant after parsing

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The outnorqst exit in rpcrdmareplyhandler branches away before the credit clamp, so a reply that matches no pending request reaches outpost carrying the raw credit value...

CVE-2026-72460

CVE-2026-72460 affects the Linux kernel’s AppArmor path: aa_change_profile() builds a replacement label with fn_label_build_in_scope() before the no_new_privs subset check, and the build helper may return NULL/ERR_PTR, with the result previously passed to aa_label_is_unconfined_subset() without I...