9084 matches found
CVE-2026-72222
In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...
CVE-2026-72221 sunrpc: wait for in-flight TLS handshake callback when cancel loses race
In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When waitforcompletioninterruptibletimeout in svctcphandshake returns 0 timeout or -ERESTARTSYS signal and tlshandshakecancel then returns false,...
CVE-2026-72219
In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlmfile leak when nlmdofopen fails A client can repeatedly drive nlmdofopen failures by presenting file handles that the underlying export rejects. After kzallocobj succeeds in nlmlookupfile, the freshly allocated...
CVE-2026-72219 lockd: Plug nlm_file leak when nlm_do_fopen() fails
In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlmfile leak when nlmdofopen fails A client can repeatedly drive nlmdofopen failures by presenting file handles that the underlying export rejects. After kzallocobj succeeds in nlmlookupfile, the freshly allocated...
CVE-2026-72216
In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: Fix leak when custom dumpsegments addition fails Free allocated minidumpregion 'name' in qcomaddminidumpsegments when failing before adding the region to 'dumpsegments'. Otherwise, the 'name' is not tracked and ...
CVE-2026-72217
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdrbuftobvec stores before writing xdrbuftobvec writes a biovec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When the...
CVE-2026-72212
In the Linux kernel, the following vulnerability has been resolved: mm/memoryhotplug: fix incorrect altmap passing in error path In createaltmapsandmemoryblocks, when archaddmemory succeeds with memmaponmemory enabled, the vmemmap pages are allocated from params.altmap. If creatememoryblockdevice...
CVE-2026-72208
In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfsealookup and ntfslistxattr, this verifies that there is enough space in the EA entry before accessing the nextentryoffset field of the EA entry...
CVE-2026-72204
In the Linux kernel, the following vulnerability has been resolved: ntfs: centalize $INDEXROOT header validation Add a dedicated helper to perform stricter validation of $INDEXROOT and use it for both directory inodes and named index inodes. This keeps the root size and header geometry checks...
CVE-2026-72201
In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index entries on reading Validate index entries immediately after reading an index root or index block from disk. This eliminates repeated checks in lookup and readdir, and reduce the risk of missing checks in thos...
CVE-2026-72198 ntfs: reject non-resident records for resident-only attributes
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject non-resident records for resident-only attributes The shared lookup-time attribute validator rejects non-resident $FILENAME and $VOLUMENAME records because their formats require resident values and callers handle...
CVE-2026-72194
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indxfindbuffer to prevent stack overflow indxfindbuffer recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded recursion,...
CVE-2026-72195 fs/ntfs3: bound attr_off in UpdateResidentValue against data_off
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attroff in UpdateResidentValue against dataoff In doaction's UpdateResidentValue case fslog.c:3307, lrh-attroff and lrh-redolen come from the on-disk LRH. When they satisfy aoff + dlen res.dataoff, the assignment...
CVE-2026-72192 ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...
CVE-2026-72180
In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: preserve pmdswpuffdwp on device-private PMD downgrade changenonpresenthugepmd rewrites a writable device-private PMD swap entry into a readable one without carrying pmdswpuffdwp across. The PTE-level...
CVE-2026-72174
In the Linux kernel, the following vulnerability has been resolved: fs/proc/taskmmu: fix hugetlb self-deadlock in pagemapscanptehole A PAGEMAPSCAN ioctl requesting PMSCANWPMATCHING on a hugetlb VMA hangs the calling thread, unkillably, as soon as the scan reaches an unpopulated part of the range:...
CVE-2026-72172
In the Linux kernel, the following vulnerability has been resolved: mm/mminit: fix uninitialized struct pages for ZONEDEVICE If DAX memory is hotplugged into an unoccupied subsection of an early section, sectionactivate reuses the unoptimized boot memmap. However, compoundnrpages still assumes th...
EUVD-2026-58927
In the Linux kernel, the following vulnerability has been resolved: kho: make sure scratch size is always aligned by CMAMINALIGNMENTBYTES When using scratchscale, the scratch sizes are rounded up to CMAMINALIGNMENTBYTES since they will be released as MIGRATECMA. This is not done when using fixed...
CVE-2026-72169 kho: make sure scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTES
In the Linux kernel, the following vulnerability has been resolved: kho: make sure scratch size is always aligned by CMAMINALIGNMENTBYTES When using scratchscale, the scratch sizes are rounded up to CMAMINALIGNMENTBYTES since they will be released as MIGRATECMA. This is not done when using fixed...