CVE-2026-72488

In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdwaddelementgroupcount found by syzkaller The original implementation caused an out-of-bounds memory access in the sdwaddelementgroupcount for-loop when i == num. for i = 0; i ratesi && lane == group-lanesi...

CVE-2026-72489

In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvecrxcompleted In nvecrxcompleted, when an incomplete RX transfer is detected, nvecmsgfree is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately aft...

CVE-2026-72485

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...

CVE-2026-72482

In the Linux kernel, the following vulnerability has been resolved: gpib: fix double decrement of descriptorbusy in commandioctl commit d1857f8296dc "gpib: fix use-after-free in IO ioctl handlers" introduced a descriptorbusy reference counter to pin struct gpibdescriptor across IO ioctl operation...

CVE-2026-72483

In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421: Fix shift-out-of-bounds in max3421hubcontrol The max3421hubcontrol function handles USB hub class requests to the virtual root hub. In the default branches of both the ClearPortFeature and SetPortFeature switc...

CVE-2026-72479

In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: handle I2C read errors in mma8452read Currently, If i2csmbusreadi2cblockdata fails but mma8452setruntimepmstate succeeds, mma8452read returns 0. As a result, the caller mma8452readraw assumes the read was...

CVE-2026-72477

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: call ntfsbadinode when failing to rename It is safe to call ntfsbadinode on live inodes since: commit 519b078998ce "fs/ntfs3: Exclude call makebadinode for live nodes." The WARNON was added when it wasn't safe by: commi...

CVE-2026-72468

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize reid before removal registration rpcrdmacreateid registers ep-rern with the rpcrdma ibclient before returning the new rdmacmid to rpcrdmaepcreate. However rpcrdmaepcreate currently stores that pointer in...

CVE-2026-72457

In the Linux kernel, the following vulnerability has been resolved: apparmor: fail policy unpack on accept2 allocation failure unpackpdb may need to allocate a missing ACCEPT2 table for older policy data. If that allocation failed, it set an error message but jumped to the success path, returning...

CVE-2026-72454

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3chciaddrtodev i3chciaddrtodev walks bus-devs.i3c, which is protected by bus.lock rwsem. However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows concurrent...

CVE-2026-72452

In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intelcrtcputcolorblobs drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intelcrtcprepareclearedstate, which fre...

CVE-2026-72451

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrmstatelock. Thus it's possible for someone else to kill the state after it passed...

CVE-2026-72447

In the Linux kernel, the following vulnerability has been resolved: sctp: hold socket lock when dumping endpoints in sctpdiag SCTPDIAG endpoint dumping was traversing endpoint address lists without holding locksock, while those lists could change concurrently via socket operations e.g., bindx...

CVE-2026-72446

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: reject stream disable with no active interface handleuaudiostreamreq resolves an interface index with infoidxfromifnum, which returns -EINVAL when no interface matches. The enable branch and the response:...

CVE-2026-72442

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix and simplify IP6IP6 tunnel handling Fix nfflowip6tunnelproto to use pskbmaypull instead of skbheaderpointer to ensure the outer IPv6 header is in the skb headroom, which is required for subsequent packet...

CVE-2026-72440

In the Linux kernel, the following vulnerability has been resolved: md/raid1: fix writespending and barrier reference leaks on write failures raid1makerequest acquires a writespending reference with mdwritestart before calling raid1writerequest. Several failure paths in raid1writerequest complete...

CVE-2026-72438

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writespending and barrier reference leaks on discard failures raid10makerequest acquires a writespending reference with mdwritestart before calling raid10handlediscard. Several failure paths in raid10handlediscard...

CVE-2026-72436

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use testbit in lockless RCU readers in hash types Sashiko pointed out that there are a few lockless RCU readers using testbit which is a relaxed atomic operation and provides no memory barrier guarantees...

CVE-2026-72437

In the Linux kernel, the following vulnerability has been resolved: md/raid1: free r1bio when REQNOWAIT is set and read would block on retry When a read is retried, raid1readrequest may be called with a pre-allocated r1bio. If waitreadbarrier fails for a REQNOWAIT read, the bio is completed and t...

CVE-2026-72435

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix order of kfreercu and rcuassignpointer Sashiko pointed out that kfreercu was called before rcuassignpointer in handling the comment extension. Fix the order so that rcuassignpointer called first...