CVE-2026-72354 ntfs: avoid stale runlist element dereference in MFT writeback

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfswritemftblock maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlistelement under ni-runlist.lock, drops the loc...

CVE-2026-72353 ntfs: avoid stale runlist element dereference in fallocate

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in fallocate ntfsattrfallocate allocates holes and delayed allocations inside initialized size by looking up the current runlist element under ni-runlist.lock. The returned struct...

EUVD-2026-59252

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in fallocate ntfsattrfallocate allocates holes and delayed allocations inside initialized size by looking up the current runlist element under ni-runlist.lock. The returned struct...

CVE-2026-72353

CVE-2026-72353 relates to the Linux kernel NTFS runlist handling during fallocate. The bug allowed a use-after-free: ntfs_attr_fallocate() reads fields from a borrowed runlist_element after releasing ni->runlist.lock, while ntfs_rl_realloc() can reallocate and free the underlying runlist, risk...

EUVD-2026-59236

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpanenableset allocates a temporary work item and schedules doenableset on systemwq, then returns to debugfs. The debugfs active operation has ended at that point, but the worker...

CVE-2026-72337 Bluetooth: 6lowpan: avoid untracked enable work

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpanenableset allocates a temporary work item and schedules doenableset on systemwq, then returns to debugfs. The debugfs active operation has ended at that point, but the worker...

EUVD-2026-59235

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control getl2capconn looks up an LE hciconn under hdev protection, but then drops that protection before reading hcon-l2capdata and before lowpancontrolwrite later dereferences...

CVE-2026-72336 Bluetooth: 6lowpan: hold L2CAP conn across debugfs control

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control getl2capconn looks up an LE hciconn under hdev protection, but then drops that protection before reading hcon-l2capdata and before lowpancontrolwrite later dereferences...

CVE-2026-72336

CVE-2026-72336 — Linux kernel, Bluetooth 6lowpan L2CAP hold across debugfs control Root cause: get_l2cap_conn() looks up an LE hci_conn under hdev protection, then drops protection before reading hcon->l2cap_data and before lowpan_control_write() dereferences conn->hcon, allowing a disconne...

EUVD-2026-59234

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hciaddadvmonitor publishes a new advmonitor in hdev-advmonitorsidr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...

CVE-2026-72335 Bluetooth: MGMT: Fix adv monitor add failure cleanup

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hciaddadvmonitor publishes a new advmonitor in hdev-advmonitorsidr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...

CVE-2026-72335

CVE-2026-72335 — Linux kernel Bluetooth MGMT fix : The vulnerability is in the MGMT path used by the Bluetooth HCI management code when adding a new adv_monitor. In hci_add_adv_monitor, an adv_monitor is published in hdev->adv_monitors_idr before the powered MSFT offload setup. If the MSFT add...

CVE-2026-72299

CVE-2026-72299 affects the Linux kernel's TIPC code path. The issue arises when tipc_sk_enqueue() runs with sk_lock held in user context and the TIPC_DUMP_ALL tracepoints dump sk_receive_queue, risking dereferencing skbs that the socket owner has already dequeued or freed. The fix limits the unsa...

CVE-2026-72299 tipc: restrict socket queue dumps in enqueue tracepoints

In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tracepoints tipcskenqueue runs with sk-sklock.slock held while the socket is owned by user context. The spinlock protects the backlog queue in this path, but it does not serialize...

CVE-2026-72299 tipc: restrict socket queue dumps in enqueue tracepoints

In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tracepoints tipcskenqueue runs with sk-sklock.slock held while the socket is owned by user context. The spinlock protects the backlog queue in this path, but it does not serialize...

EUVD-2026-59198

In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tracepoints tipcskenqueue runs with sk-sklock.slock held while the socket is owned by user context. The spinlock protects the backlog queue in this path, but it does not serialize...

EUVD-2026-58967

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate attribute values on lookup ntfsattrfind and ntfsexternalattrfind check that generic resident attribute values fit in their attribute records and that fixed-size resident values are large enough. For variable-length...

CVE-2026-72209

CVE-2026-72209 concerns the Linux kernel NTFS attribute value handling. The fix adds a shared attribute value validator and applies it before any lookup path can return an attribute (including AT_UNUSED). The validator enforces bounds for resident values, minimum resident sizes, checks variable-l...

CVE-2026-72197 fs/ntfs3: bound DeleteIndexEntryAllocation memmove length

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length In doaction's DeleteIndexEntryAllocation case, e-size comes from an on-disk INDEXBUFFER entry. When e-size makes e + e-size point past hdr + hdr-used, PtrOffsete1,...

CVE-2026-72197 fs/ntfs3: bound DeleteIndexEntryAllocation memmove length

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length In doaction's DeleteIndexEntryAllocation case, e-size comes from an on-disk INDEXBUFFER entry. When e-size makes e + e-size point past hdr + hdr-used, PtrOffsete1,...