CVE-2026-72097 dm-verity: fix a possible NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix a possible NULL pointer dereference Fix a possible NULL pointer dereference dmverityloadpinisbdevtrusted if the device has no table...

CVE-2026-72097 dm-verity: fix a possible NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix a possible NULL pointer dereference Fix a possible NULL pointer dereference dmverityloadpinisbdevtrusted if the device has no table...

CVE-2026-72097

CVE-2026-72097 involves the Linux kernel, fixing a possible NULL pointer dereference in dm-verity, occurring in dm_verity_loadpin_is_bdev_trusted when a device has no table. The document set does not provide exploitation details; it simply notes the fix. Patches are referenced in kernel.org commi...

CVE-2026-72094 dma-buf: dma-fence: Fix potential NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-fence: Fix potential NULL pointer dereference The commit mentioned in the fixes tag below introduced a mechanism through which fence producers can fully decouple from fence consumers. This, desirable, mechanism is...

CVE-2026-72094 dma-buf: dma-fence: Fix potential NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-fence: Fix potential NULL pointer dereference The commit mentioned in the fixes tag below introduced a mechanism through which fence producers can fully decouple from fence consumers. This, desirable, mechanism is...

CVE-2026-72094

The CVE-2026-72094 entry describes a Linux kernel vulnerability in dma-buf: dma-fence where a race between the signaled-bit and the dma_fence_ops pointer could allow a NULL dereference on weakly ordered platforms. The fix decouples fence producers and consumers by using the signaled-bit as the de...

EUVD-2026-59052

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-fence: Fix potential NULL pointer dereference The commit mentioned in the fixes tag below introduced a mechanism through which fence producers can fully decouple from fence consumers. This, desirable, mechanism is...

EUVD-2026-59050

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit op amdxdnacmdsubmit calls xdna-devinfo-ops-cmdsubmit unconditionally, but only aie2devops defines that callback. aie4vfops the AIE4 SR-IOV virtual function does...

CVE-2026-72092 accel/amdxdna: reject command submission on devices without a submit op

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit op amdxdnacmdsubmit calls xdna-devinfo-ops-cmdsubmit unconditionally, but only aie2devops defines that callback. aie4vfops the AIE4 SR-IOV virtual function does...

CVE-2026-72092

The CVE-2026-72092 issue affects the Linux kernel’s accel/amdxdna path: aie2_dev_ops defines cmd_submit while aie4_vf_ops does not, so the AMDXDNA_EXEC_CMD ioctl on AIE4 devices may call a NULL function pointer and oops. The kernel now rejects submission early with -EOPNOTSUPP when no cmd_submit ...

CVE-2026-72092 accel/amdxdna: reject command submission on devices without a submit op

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit op amdxdnacmdsubmit calls xdna-devinfo-ops-cmdsubmit unconditionally, but only aie2devops defines that callback. aie4vfops the AIE4 SR-IOV virtual function does...

EUVD-2026-59049

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...

CVE-2026-72091 accel/amdxdna: reject user command submission without a command BO

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...

CVE-2026-72091 accel/amdxdna: reject user command submission without a command BO

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...

CVE-2026-72091

The CVE-2026-72091 in the Linux kernel accelerator amdxdna driver describes a NULL dereference when a user submits an AMDXDNA_EXEC_CMD with cmd handle 0 (AMDXDNA_INVALID_BO_HANDLE). The sequence: accel/amdxdna: submit_execbuf passes a user BO handle to amdxdna_cmd_submit with drv_cmd == NULL; sin...

CVE-2026-72082

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix refcount leak in efcthwioabort When efcthwreqtagalloc fails in efcthwioabort, the error path returns -ENOSPC without releasing the reference obtained via krefgetunlesszero earlier in the function. All other...

CVE-2026-72077

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix firmware leak in async update The firmware object was not being released if validation failed. Use freefirmware to ensure the firmware is always released...

CVE-2026-72062

In the Linux kernel, the following vulnerability has been resolved: gpio: mt7621: avoid corruption of shared interrupt trigger state The bank-shared fields like 'rising' and 'falling' are modified using non-atomic read-modify-write operations. Since every gpio chip instance represents an entire...

CVE-2026-72060 net: ethernet: ti: icssg: guard PA stat lookups

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups icssgndogetstats64 unconditionally calls emacgetstatbyname with FW PA stat names regardless of whether the PA stats block is present on the hardware. emacgetstatbyname already guard...

EUVD-2026-59018

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups icssgndogetstats64 unconditionally calls emacgetstatbyname with FW PA stat names regardless of whether the PA stats block is present on the hardware. emacgetstatbyname already guard...