EUVD-2026-59158

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Release reserved memory on cleanup The MT8192 AFE probe calls ofreservedmemdeviceinit and falls back to preallocated buffers when no reserved memory region is available. When the reserved memory assignment...

CVE-2026-72259

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Release reserved memory on cleanup The MT8192 AFE probe calls ofreservedmemdeviceinit and falls back to preallocated buffers when no reserved memory region is available. When the reserved memory assignment...

CVE-2026-72259 ASoC: mediatek: mt8192: Release reserved memory on cleanup

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Release reserved memory on cleanup The MT8192 AFE probe calls ofreservedmemdeviceinit and falls back to preallocated buffers when no reserved memory region is available. When the reserved memory assignment...

EUVD-2026-59157

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8183: Release reserved memory on cleanup The MT8183 AFE probe can assign reserved memory with ofreservedmemdeviceinit, but the assignment is never released on driver removal or later probe failures. Register a...

CVE-2026-72258

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8183: Release reserved memory on cleanup The MT8183 AFE probe can assign reserved memory with ofreservedmemdeviceinit, but the assignment is never released on driver removal or later probe failures. Register a...

CVE-2026-72258 ASoC: mediatek: mt8183: Release reserved memory on cleanup

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8183: Release reserved memory on cleanup The MT8183 AFE probe can assign reserved memory with ofreservedmemdeviceinit, but the assignment is never released on driver removal or later probe failures. Register a...

CVE-2026-72258

CVE-2026-72258 concerns the Linux kernel ASoC: mediatek mt8183 driver. The issue is that the MT8183 AFE probe can assign reserved memory via of_reserved_mem_device_init(), but the reservation is not released when the driver is removed or on subsequent probe failures. The flaw is resolved by regis...

CVE-2026-72257

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm: fix NULL pointer dereference in graphcallback When q6apmfreefragments is called it frees rxdata.buf/txdata.buf and sets them to NULL under graph-lock. A late DSP buffer-done response can race with this:...

CVE-2026-72257 ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm: fix NULL pointer dereference in graphcallback When q6apmfreefragments is called it frees rxdata.buf/txdata.buf and sets them to NULL under graph-lock. A late DSP buffer-done response can race with this:...

CVE-2026-72257 ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm: fix NULL pointer dereference in graphcallback When q6apmfreefragments is called it frees rxdata.buf/txdata.buf and sets them to NULL under graph-lock. A late DSP buffer-done response can race with this:...

EUVD-2026-59156

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm: fix NULL pointer dereference in graphcallback When q6apmfreefragments is called it frees rxdata.buf/txdata.buf and sets them to NULL under graph-lock. A late DSP buffer-done response can race with this:...

CVE-2026-72257

CVE-2026-72257 affects the Linux kernel ASoC qcom stack (q6apm). The root cause is a potential NULL pointer dereference in graph_callback when a late DSP buffer-done response races with q6apm_free_fragments() which frees and NULLs rx/tx buffers under graph->lock. The code path can dereference ...

CVE-2026-72256

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This causes a state confusion bug when the raw table C...

CVE-2026-72256 netfilter: xt_cluster: reject template conntracks in hash match

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This causes a state confusion bug when the raw table C...

CVE-2026-72256 netfilter: xt_cluster: reject template conntracks in hash match

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This causes a state confusion bug when the raw table C...

EUVD-2026-59155

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This causes a state confusion bug when the raw table C...

EUVD-2026-59153

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftfib: reject fib expression on the netdev egress hook A fib expression in a netdev egress base chain dereferences nftinpkt, NULL on the transmit path, causing a NULL pointer dereference at eval. nftfibvalidate masks...

CVE-2026-72255 netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: pin bridge device while NFQUEUE holds fake dst The brnetfilter fake rtable is embedded in struct netbridge and is attached to bridged packets with skbdstsetnoref. If such a packet is queued to NFQUEUE, nfqueue...

CVE-2026-72254 netfilter: nft_fib: reject fib expression on the netdev egress hook

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftfib: reject fib expression on the netdev egress hook A fib expression in a netdev egress base chain dereferences nftinpkt, NULL on the transmit path, causing a NULL pointer dereference at eval. nftfibvalidate masks...

CVE-2026-72255 netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: pin bridge device while NFQUEUE holds fake dst The brnetfilter fake rtable is embedded in struct netbridge and is attached to bridged packets with skbdstsetnoref. If such a packet is queued to NFQUEUE, nfqueue...