CVE-2026-72338 net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload

In the Linux kernel, the following vulnerability has been resolved: net/sched: actpedit: fix TOCTOU heap OOB write in tc offload There is a TOCTOU race condition in flower lockless approach between sizing a flowrule buffer and filling it. [email protected] reports: The clsflower...

CVE-2026-72338 net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload

In the Linux kernel, the following vulnerability has been resolved: net/sched: actpedit: fix TOCTOU heap OOB write in tc offload There is a TOCTOU race condition in flower lockless approach between sizing a flowrule buffer and filling it. [email protected] reports: The clsflower...

CVE-2026-72300 ASoC: SOF: topology: validate vendor array size before parsing

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

EUVD-2026-59161

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

CVE-2026-72261

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in sndsofupdatecontrol In sndsofupdatecontrol, firmware-provided cdata-numelems is checked against localcdata-data-size but never against the actual allocation size. If localcdata-data-size...

CVE-2026-72262

CVE-2026-72262 : In the Linux kernel ASoC SOF ipc3-control pathway, there is a heap overflow in bytes_ext_put/get due to incorrect bounds checks on the ipc_control_data buffer. The cdata->data payload sits after the struct and max_size was evaluated against the entire allocation, allowing writ...

CVE-2026-72262 ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

CVE-2026-72262 ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

CVE-2026-72222

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...

CVE-2026-72218

In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlmfile refcount leak on cached nlmdofopen failure The cached-file path in nlmlookupfile reaches the found: label unconditionally, even when nlmdofopen fails. At that label result and file-fcount are updated before th...

CVE-2026-72209

CVE-2026-72209 concerns the Linux kernel NTFS attribute value handling. The fix adds a shared attribute value validator and applies it before any lookup path can return an attribute (including AT_UNUSED). The validator enforces bounds for resident values, minimum resident sizes, checks variable-l...

EUVD-2026-58960

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid heap allocation for free-cluster readahead state getnrfreeclusters allocates a temporary filerastate before it publishes the precomputed free cluster count, sets NVolFreeClusterKnown, and wakes vol-freewaitq. If that...

CVE-2026-72202 ntfs: avoid heap allocation for free-cluster readahead state

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid heap allocation for free-cluster readahead state getnrfreeclusters allocates a temporary filerastate before it publishes the precomputed free cluster count, sets NVolFreeClusterKnown, and wakes vol-freewaitq. If that...

CVE-2026-72202

Technical details are not publicly available in the provided documents. Monitor for updates from vendors and security trackers for affected products, patches, and remediation status.

CVE-2026-72202 ntfs: avoid heap allocation for free-cluster readahead state

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid heap allocation for free-cluster readahead state getnrfreeclusters allocates a temporary filerastate before it publishes the precomputed free cluster count, sets NVolFreeClusterKnown, and wakes vol-freewaitq. If that...

CVE-2026-72199 ntfs: validate resident index root values on lookup

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident index root values on lookup Resident $INDEXROOT values carry index header fields that callers consume after lookup. Some callers already validate parts of the layout before walking entries, but those check...

CVE-2026-72192

The CVE-2026-72192 issue affects the Linux kernel ntfs3 code. Specifically, indx_insert_into_root before hdr_insert_head can overrun a kmalloc(index_block_size) when shrinking root->index_block_size (e.g., to 512) after the root is populated. A crafted NTFS image triggers a memcpy of attacker-...

CVE-2026-72192 ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...

EUVD-2026-58950

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...

CVE-2026-72192 ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...