EUVD-2026-59055

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix a possible NULL pointer dereference Fix a possible NULL pointer dereference dmverityloadpinisbdevtrusted if the device has no table...

CVE-2026-72097 dm-verity: fix a possible NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix a possible NULL pointer dereference Fix a possible NULL pointer dereference dmverityloadpinisbdevtrusted if the device has no table...

EUVD-2026-59052

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-fence: Fix potential NULL pointer dereference The commit mentioned in the fixes tag below introduced a mechanism through which fence producers can fully decouple from fence consumers. This, desirable, mechanism is...

CVE-2026-72094 dma-buf: dma-fence: Fix potential NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-fence: Fix potential NULL pointer dereference The commit mentioned in the fixes tag below introduced a mechanism through which fence producers can fully decouple from fence consumers. This, desirable, mechanism is...

CVE-2026-72094

The CVE-2026-72094 entry describes a Linux kernel vulnerability in dma-buf: dma-fence where a race between the signaled-bit and the dma_fence_ops pointer could allow a NULL dereference on weakly ordered platforms. The fix decouples fence producers and consumers by using the signaled-bit as the de...

CVE-2026-72094 dma-buf: dma-fence: Fix potential NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-fence: Fix potential NULL pointer dereference The commit mentioned in the fixes tag below introduced a mechanism through which fence producers can fully decouple from fence consumers. This, desirable, mechanism is...

CVE-2026-72092

The CVE-2026-72092 issue affects the Linux kernel’s accel/amdxdna path: aie2_dev_ops defines cmd_submit while aie4_vf_ops does not, so the AMDXDNA_EXEC_CMD ioctl on AIE4 devices may call a NULL function pointer and oops. The kernel now rejects submission early with -EOPNOTSUPP when no cmd_submit ...

CVE-2026-72092 accel/amdxdna: reject command submission on devices without a submit op

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit op amdxdnacmdsubmit calls xdna-devinfo-ops-cmdsubmit unconditionally, but only aie2devops defines that callback. aie4vfops the AIE4 SR-IOV virtual function does...

EUVD-2026-59050

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit op amdxdnacmdsubmit calls xdna-devinfo-ops-cmdsubmit unconditionally, but only aie2devops defines that callback. aie4vfops the AIE4 SR-IOV virtual function does...

CVE-2026-72092 accel/amdxdna: reject command submission on devices without a submit op

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit op amdxdnacmdsubmit calls xdna-devinfo-ops-cmdsubmit unconditionally, but only aie2devops defines that callback. aie4vfops the AIE4 SR-IOV virtual function does...

EUVD-2026-59049

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...

CVE-2026-72091 accel/amdxdna: reject user command submission without a command BO

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...

CVE-2026-72091

The CVE-2026-72091 in the Linux kernel accelerator amdxdna driver describes a NULL dereference when a user submits an AMDXDNA_EXEC_CMD with cmd handle 0 (AMDXDNA_INVALID_BO_HANDLE). The sequence: accel/amdxdna: submit_execbuf passes a user BO handle to amdxdna_cmd_submit with drv_cmd == NULL; sin...

CVE-2026-72091 accel/amdxdna: reject user command submission without a command BO

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...

CVE-2026-72062

In the Linux kernel, the following vulnerability has been resolved: gpio: mt7621: avoid corruption of shared interrupt trigger state The bank-shared fields like 'rising' and 'falling' are modified using non-atomic read-modify-write operations. Since every gpio chip instance represents an entire...

EUVD-2026-59018

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups icssgndogetstats64 unconditionally calls emacgetstatbyname with FW PA stat names regardless of whether the PA stats block is present on the hardware. emacgetstatbyname already guard...

CVE-2026-72060

The CVE-2026-72060 entry concerns a Linux kernel issue in the TI ICSSG Ethernet driver where icssg_ndo_get_stats64() unconditionally calls emac_get_stat_by_name() for FW PA stats even if the PA stats block is absent. The root cause is that emac_get_stat_by_name() relies on pa_stats guard, but the...

CVE-2026-72036 net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

In the Linux kernel, the following vulnerability has been resolved: net/sched: schmultiq: Replace direct dequeue call with peek and qdiscdequeuepeeked multiqdequeue takes a packet from a band's child with a direct -dequeue call after multiqpeek peeked it. When the child is non-work-conserving the...

EUVD-2026-58994

In the Linux kernel, the following vulnerability has been resolved: net/sched: schmultiq: Replace direct dequeue call with peek and qdiscdequeuepeeked multiqdequeue takes a packet from a band's child with a direct -dequeue call after multiqpeek peeked it. When the child is non-work-conserving the...

EUVD-2026-58993

In the Linux kernel, the following vulnerability has been resolved: net/sched: schtaprio: Replace direct dequeue call with peek and qdiscdequeuepeeked When taprio's software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gsoskb; tapriodequeuefromtxq then tak...