CVE-2026-72006 net/mlx5: free mlx5_st_idx_data on final dealloc

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: free mlx5stidxdata on final dealloc Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints e.g. churning RDMA MRs leak one struct mlx5stidxdata per cycle; kmemleak flags it as unreferenced...

CVE-2026-72004 wifi: mac80211: fix memory leak in ieee80211_register_hw()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix memory leak in ieee80211registerhw If kmemdup fails while copying supported band structures, the error path jumps to failrate. This skips ratecontroldeinitialize and leaks the initialized local-ratectrl. Fix...

EUVD-2026-59103

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix memory leak in ieee80211registerhw If kmemdup fails while copying supported band structures, the error path jumps to failrate. This skips ratecontroldeinitialize and leaks the initialized local-ratectrl. Fix...

CVE-2026-72004 wifi: mac80211: fix memory leak in ieee80211_register_hw()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix memory leak in ieee80211registerhw If kmemdup fails while copying supported band structures, the error path jumps to failrate. This skips ratecontroldeinitialize and leaks the initialized local-ratectrl. Fix...

CVE-2026-72004

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix memory leak in ieee80211registerhw If kmemdup fails while copying supported band structures, the error path jumps to failrate. This skips ratecontroldeinitialize and leaks the initialized local-ratectrl. Fix...

CVE-2026-72004

CVE-2026-72004 — Linux kernel (wifi/mac80211) memory leak : In ieee80211_register_hw(), if kmemdup() fails while copying supported band structures, the error path jumps to fail_rate, skipping rate_control_deinitialize() and leaking the initialized local->rate_ctrl. The fix introduces a fail_ba...

EUVD-2026-59102

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmfnotifyauthframerx takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmtframelen = e-datal...

CVE-2026-72003

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmfnotifyauthframerx takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmtframelen = e-datal...

CVE-2026-68479

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow...

CVE-2026-68478

The CVE-2026-68478 vulnerability is in the Linux kernel’s memstick handling (ms_block/ftl). msb_ftl_initialize computes zone_count from block_count without proper bound checking, indexing free_block_count[] (size MS_MAX_ZONES = 16). A card reporting more than 16 zones (8192 blocks) can cause out-...

CVE-2026-68478 memstick: ms_block: reject a card that reports too many blocks

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

CVE-2026-68478

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

CVE-2026-68478 memstick: ms_block: reject a card that reports too many blocks

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

CVE-2026-68476

In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation ipvsgetoutrt calls skbensurewritable which may reallocate skb-head...

CVE-2026-68476

CVE-2026-68476 concerns the Linux kernel where the IPVS path may reallocate skb->head via skb_ensure_writable() called from __ip_vs_get_out_rt(), allowing a header reallocation during packet handling. This could impact memory/systems processing of IPVS routes. The entry notes a high-severity i...

CVE-2026-68476 ipvs: reload ip header after head reallocation

In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation ipvsgetoutrt calls skbensurewritable which may reallocate skb-head...

EUVD-2026-59097

In the Linux kernel, the following vulnerability has been resolved: reset: sunxi: fix memory region leak on ioremap failure In sunxiresetinit, when ioremap fails, the memory region obtained via requestmemregion is not released, leading to a resource leak. Add an errmemregion label to properly...

CVE-2026-68475 reset: sunxi: fix memory region leak on ioremap failure

In the Linux kernel, the following vulnerability has been resolved: reset: sunxi: fix memory region leak on ioremap failure In sunxiresetinit, when ioremap fails, the memory region obtained via requestmemregion is not released, leading to a resource leak. Add an errmemregion label to properly...

CVE-2026-68475 reset: sunxi: fix memory region leak on ioremap failure

In the Linux kernel, the following vulnerability has been resolved: reset: sunxi: fix memory region leak on ioremap failure In sunxiresetinit, when ioremap fails, the memory region obtained via requestmemregion is not released, leading to a resource leak. Add an errmemregion label to properly...

CVE-2026-68475

Mode C: The CVE-2026-68475 entry concerns a Linux kernel sunxi reset path. In sunxi_reset_init(), if ioremap() fails, the memory region obtained with request_mem_region() is not released, causing a resource leak. The fix adds an err_mem_region label to properly release that memory region before f...