CVE-2026-72197 fs/ntfs3: bound DeleteIndexEntryAllocation memmove length

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length In doaction's DeleteIndexEntryAllocation case, e-size comes from an on-disk INDEXBUFFER entry. When e-size makes e + e-size point past hdr + hdr-used, PtrOffsete1,...

EUVD-2026-59050

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit op amdxdnacmdsubmit calls xdna-devinfo-ops-cmdsubmit unconditionally, but only aie2devops defines that callback. aie4vfops the AIE4 SR-IOV virtual function does...

CVE-2026-72092 accel/amdxdna: reject command submission on devices without a submit op

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit op amdxdnacmdsubmit calls xdna-devinfo-ops-cmdsubmit unconditionally, but only aie2devops defines that callback. aie4vfops the AIE4 SR-IOV virtual function does...

EUVD-2026-59049

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...

CVE-2026-72091 accel/amdxdna: reject user command submission without a command BO

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...

CVE-2026-72091

The CVE-2026-72091 in the Linux kernel accelerator amdxdna driver describes a NULL dereference when a user submits an AMDXDNA_EXEC_CMD with cmd handle 0 (AMDXDNA_INVALID_BO_HANDLE). The sequence: accel/amdxdna: submit_execbuf passes a user BO handle to amdxdna_cmd_submit with drv_cmd == NULL; sin...

CVE-2026-72091 accel/amdxdna: reject user command submission without a command BO

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...

CVE-2026-72084 scsi: target: Bound PR-OUT TransportID parsing to the received buffer

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer corescsi3decodespeciport and corescsi3emulateregisterandmove hand the raw PERSISTENT RESERVE OUT parameter buffer to targetparseprouttransportid without tellin...

CVE-2026-72084 scsi: target: Bound PR-OUT TransportID parsing to the received buffer

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer corescsi3decodespeciport and corescsi3emulateregisterandmove hand the raw PERSISTENT RESERVE OUT parameter buffer to targetparseprouttransportid without tellin...

CVE-2026-72047 ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit

In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210testintdriverwrite and ca8210testintuserread exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as the byte count to...

CVE-2026-72047

Summary: CVE-2026-72047 affects the Linux kernel, specifically the ieee802154 ca8210 driver. A 64‑bit build flaw occurs when ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange a kmalloc’d buffer pointer through a struct kfifo and pass a literal 4 as the byte count to kfifo_in...

CVE-2026-72047 ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit

In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210testintdriverwrite and ca8210testintuserread exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as the byte count to...

EUVD-2026-59005

In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210testintdriverwrite and ca8210testintuserread exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as the byte count to...

PT-2026-72280

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the drm sched worker of the Linux kernel. The issue occurs when amdxdna drm submit execbuf passes a user-supplied command BO handle to amdxdna cmd...

Linux Distros Unpatched Vulnerability : CVE-2026-74472

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ublk: reset kernel-owned devinfo fields in ublkctrladddev ublkctrladddev memcpys the userspace ublksrvctrldevinfo into ub-devinfo and then fixes up the fields t...

CVE-2026-72047: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210testintdriverwrite and ca8210testintuserread exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as the byte count to...

CVE-2026-74477: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobeexpire Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clone path: BUG: kernel NULL pointer dereference, address:...

PT-2026-72865

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rxrpc component where the rxrpc receiving reply function fails to properly handle the reception of a reply DATA packet before any request DATA packets have been se...

CVE-2026-72033: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fillfrompart fillfrompart computes the size of a directory entry in sizet but stores it in a u32. An entry length near U32MAX wraps it to a small value, bypasses the bounds check, a...

CVE-2026-72092: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit op amdxdnacmdsubmit calls xdna-devinfo-ops-cmdsubmit unconditionally, but only aie2devops defines that callback. aie4vfops the AIE4 SR-IOV virtual function does...