CVE-2026-72431

CVE-2026-72431 describes a use-after-free in Linux kernel /proc/allocinfo handling after module unload. The issue arises because allocinfo_start() reinitializes the codetag iterator only at pos=0, but subsequent reads reuse a cached iterator state. allocinfo_stop() releases mod_lock between batch...

CVE-2026-72425

In the Linux kernel, the following vulnerability has been resolved: ice: fix FDIR CTRL VSI resource leak in iceresetallvfs Resetting all VFs causes resource leak on VFs with FDIR filters enabled as CTRL VSIs are only invalidated and not freed. Fix by using icevfctrlvsirelease instead of...

CVE-2026-72422

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn-preauthinfo in concurrent SMB2 NEGOTIATE conn-preauthinfo is shared connection state struct preauthintegrityinfo, kmalloc-96 that is allocated and freed by the SMB2 NEGOTIATE handler and read by...

CVE-2026-72423

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an optssz argument. The verifier checks only the memory range described by optssz, but the wrappers...

CVE-2026-72415

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Validate written enum value in geputenumdouble geputenumdouble passes the user-supplied enumeration index item0 to sndsocenumitemtoval without checking it against the number of items in the enum: ret =...

CVE-2026-72401

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insnauxdata leak on verifier errfreeenv path When bpfcheck allocates env-insnauxdata successfully but later fails to allocate env-succ, it jumps directly to errfreeenv. The existing vfreeenv-insnauxdata sits before the...

CVE-2026-72400

In the Linux kernel, the following vulnerability has been resolved: seg6: validate SRH length before reading fixed fields seg6validatesrh reads fixed SRH fields such as srh-type and srh-hdrlen before checking that the supplied length covers the fixed struct ipv6srhdr fields. The BPF SEG6 encap pa...

CVE-2026-72393

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: don't cache shinfo across skb realloc fbnictxlso calls skbcowhead which may reallocate the skb including the shared info. We can't use the pointer calculated before the call. BUG: KASAN: slab-use-after-free in...

CVE-2026-72384

In the Linux kernel, the following vulnerability has been resolved: irqchip/ts4800: Fix missing chained handler cleanup on remove The driver installs a chained handler for the parent interrupt during probe using irqsetchainedhandleranddata, but the remove function does not clear this handler. Thi...

CVE-2026-72381

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistentid race the fp-owner.name compare-read in ksmbdvfscomparedurableowner against the kfr...

CVE-2026-72380

In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response reqid before indexing rsp pvcallsfronteventhandler takes reqid directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a store, wi...

CVE-2026-72376

CVE-2026-72376 refers to a Linux kernel issue in the AFS subsystem where the counter net->cells_outstanding was incremented before the failure check of idr_alloc_cyclic(), leaving the count incremented when an error occurs. The fix corrects the order of operations so the increment happens only...

CVE-2026-72375

In the Linux kernel, the following vulnerability has been resolved: afs: Fix reinitialisation of the inode, in particular -lockwork It seems that initalising afsvnode::lockwork a single time in the slab's init function isn't sufficient for workstructs. This results in the DEBUGOBJECTS debugging...

CVE-2026-72374

In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incomi...

CVE-2026-72372

CVE-2026-72372 affects the Linux kernel in the afs subsystem, fixing a race when modifying net->cells_dyn_ino. The patch adds exclusive locking via net->cells_lock and changes the removal of a cell from net->cells_dyn_ino to afs_destroy_cell_work() instead of afs_cell_destroy(), because ...

CVE-2026-72371

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFSVOLUMERMTREE is set on Fix afsinsertvolumeintocell to set AFSVOLUMERMTREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volume to be...

CVE-2026-72370

In the Linux kernel, the following vulnerability has been resolved: iomap: release pages on atomic dio size mismatch If bioiovitergetpages or the bounce helper succeeds but builds a short bio, the REQATOMIC size check rejects it before submission. The old error path only dropped the bio reference...

CVE-2026-72367

In the Linux kernel, the following vulnerability has been resolved: iomap: guard iosize EOF trim against concurrent truncate underflow iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that iosize tracks only valid data within EOF. This trims iosize when a...

CVE-2026-72363

Summary of CVE-2026-72363 : A Linux kernel issue in the netfs subsystem: when ENOMEM occurs during writeback iteration, the current folio’s state is not properly updated, requiring the folio to be redirtied and unlocked before invoking the terminal writeback_iter(). The available connected docume...

CVE-2026-72363

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio state after ENOMEM whilst under writeback iteration Fix the state of the current folio when ENOMEM occurs during writeback iteration. The folio needs to be redirtied and unlocked before the terminal writebackiter...