CVE-2026-72106

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

CVE-2026-72090

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

CVE-2026-72092

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit op amdxdnacmdsubmit calls xdna-devinfo-ops-cmdsubmit unconditionally, but only aie2devops defines that callback. aie4vfops the AIE4 SR-IOV virtual function does...

CVE-2026-72091

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...

CVE-2026-72090

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

UBUNTU-CVE-2026-72090

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

CVE-2026-72106

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

UBUNTU-CVE-2026-72092

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit op amdxdnacmdsubmit calls xdna-devinfo-ops-cmdsubmit unconditionally, but only aie2devops defines that callback. aie4vfops the AIE4 SR-IOV virtual function does...

CVE-2026-72174

In the Linux kernel, the following vulnerability has been resolved: fs/proc/taskmmu: fix hugetlb self-deadlock in pagemapscanptehole A PAGEMAPSCAN ioctl requesting PMSCANWPMATCHING on a hugetlb VMA hangs the calling thread, unkillably, as soon as the scan reaches an unpopulated part of the range:...

CVE-2026-72092

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit op amdxdnacmdsubmit calls xdna-devinfo-ops-cmdsubmit unconditionally, but only aie2devops defines that callback. aie4vfops the AIE4 SR-IOV virtual function does...

UBUNTU-CVE-2026-72106

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

CVE-2026-72138

In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: fix error handling in ioctl When gntdevioctlmapgrantref fails to copy the operation result back to userspace after successfully adding the mapping to the list, the error path returns -EFAULT without releasing the...

UBUNTU-CVE-2026-72091

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...

CVE-2026-68455

In the Linux kernel, the following vulnerability has been resolved: liveupdate: validate session type before performing operation The sessions ioctls are not applicable to all session types. PRESERVEFD is only applicable to outgoing sessions. RETRIEVEFD and FINISH are only valid for incoming...

CVE-2026-68455

In the Linux kernel, the following vulnerability has been resolved: liveupdate: validate session type before performing operation The sessions ioctls are not applicable to all session types. PRESERVEFD is only applicable to outgoing sessions. RETRIEVEFD and FINISH are only valid for incoming...

UBUNTU-CVE-2026-68455

In the Linux kernel, the following vulnerability has been resolved: liveupdate: validate session type before performing operation The sessions ioctls are not applicable to all session types. PRESERVEFD is only applicable to outgoing sessions. RETRIEVEFD and FINISH are only valid for incoming...

CVE-2026-74307

The CVE-2026-74307 entry describes a Linux kernel/ext4 vulnerability in EXT4_IOC_MOVE_EXT where donor file superblock validation is done late (inside mext_check_validity after acquiring inode locks), creating a deadlock with sb_writers during cross-filesystem donor use (e.g., overlayfs). The issu...

CVE-2026-72311 drm/xe: free madvise VMA array on L2 flush failure

In the Linux kernel, the following vulnerability has been resolved: drm/xe: free madvise VMA array on L2 flush failure xevmmadviseioctl allocates madviserange.vmas in getvmas. After getvmas succeeds with at least one VMA, error paths must go through freevmas so the array is released before the...

CVE-2026-72311

CVE-2026-72311 affects the Linux kernel DRM/XE path. The issue occurs in xe_vm_madvise_ioctl(), which allocates madvise_range.vmas in get_vmas(). When get_vmas() succeeds and later validation fails, control incorrectly jumps to madv_fini, skipping kfree(madvise_range.vmas) and leaking the VMA arr...

CVE-2026-72311 drm/xe: free madvise VMA array on L2 flush failure

In the Linux kernel, the following vulnerability has been resolved: drm/xe: free madvise VMA array on L2 flush failure xevmmadviseioctl allocates madviserange.vmas in getvmas. After getvmas succeeds with at least one VMA, error paths must go through freevmas so the array is released before the...