CVE-2026-72485 coresight: platform: defer connection counter increment until alloc succeeds

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...

CVE-2026-72485 coresight: platform: defer connection counter increment until alloc succeeds

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...

CVE-2026-72460 apparmor: check label build before no_new_privs test

In the Linux kernel, the following vulnerability has been resolved: apparmor: check label build before nonewprivs test aachangeprofile builds a replacement label with fnlabelbuildinscope before the nonewprivs subset check. The build helper can fail and return NULL or an ERRPTR, but the result was...

EUVD-2026-59354

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to auditloguntrustedstring Commit 4a134723f9f1 "apparmor: move check for aanull file to cover all cases" intrdouced a small bug, where pathname may pass a potentially uninitialized name ...

CVE-2026-72434 netfilter: ipset: make sure gc is properly stopped

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, canceldelayedworksync was called while gc calls queuedelayedwork unconditionally which can lead not to properly shutting down the gc...

EUVD-2026-59293

In the Linux kernel, the following vulnerability has been resolved: hwmon: aspeed-g6-pwm-tach Guard fan RPM calculation against divide-by-zero Sashiko reports: In the aspeed-g6-pwm-tacho driver, the aspeedtachvaltorpm function calculates the fan RPM using the tachometer value. However, it does no...

CVE-2026-72394 hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero

In the Linux kernel, the following vulnerability has been resolved: hwmon: aspeed-g6-pwm-tach Guard fan RPM calculation against divide-by-zero Sashiko reports: In the aspeed-g6-pwm-tacho driver, the aspeedtachvaltorpm function calculates the fan RPM using the tachometer value. However, it does no...

CVE-2026-72394 hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero

In the Linux kernel, the following vulnerability has been resolved: hwmon: aspeed-g6-pwm-tach Guard fan RPM calculation against divide-by-zero Sashiko reports: In the aspeed-g6-pwm-tacho driver, the aspeedtachvaltorpm function calculates the fan RPM using the tachometer value. However, it does no...

CVE-2026-72394

The CVE pertains to the Linux kernel hwmon subsystem, specifically the aspeed-g6-pwm-tach driver. The aspeed_tach_val_to_rpm() function computes fan RPM from the tachometer value without guarding against tach value 0. If tach_div becomes 0, a subsequent do_div() division by zero triggers a kernel...

CVE-2026-72392

The CVE-2026-72392 entry describes a NULL pointer dereference in the Linux kernel during multi-batch inet6_dump_fib/walk logic for IPv6 fib6_dump_table and inet6_dump_fib. The root cause is that inet6_dump_fib() saves progress using a positional index in cb->args[1], which can be invalidated b...

CVE-2026-72385

CVE-2026-72385 concerns the Linux kernel tracing/fprobe component. The issue is a NULL pointer dereference in fprobe_fgraph_entry() caused by mis-synchronization between two walks that size and fill a shadow-stack reservation under rcu_read_lock(). If a fprobe on an already-live ip becomes visibl...

CVE-2026-72369 minix: avoid overflow in bitmap block count calculation

In the Linux kernel, the following vulnerability has been resolved: minix: avoid overflow in bitmap block count calculation minixchecksuperblock uses minixblocksneeded to verify that the on-disk imap and zmap block counts are large enough for the advertised inode and zone counts. The helper...

EUVD-2026-59268

In the Linux kernel, the following vulnerability has been resolved: minix: avoid overflow in bitmap block count calculation minixchecksuperblock uses minixblocksneeded to verify that the on-disk imap and zmap block counts are large enough for the advertised inode and zone counts. The helper...

CVE-2026-72369

CVE-2026-72369 (Minix) - detail summary : The Linux kernel vulnerability arises in minix_check_superblock() where minix_blocks_needed() uses unsigned DIV_ROUND_UP(), allowing s_ninodes/s_zones near UINT_MAX to wrap to zero, making a zero bitmap-block count appear valid. This can lead to dereferen...

CVE-2026-72369 minix: avoid overflow in bitmap block count calculation

In the Linux kernel, the following vulnerability has been resolved: minix: avoid overflow in bitmap block count calculation minixchecksuperblock uses minixblocksneeded to verify that the on-disk imap and zmap block counts are large enough for the advertised inode and zone counts. The helper...

CVE-2026-72334 Bluetooth: ISO: fix malformed ISO_END/CONT handling

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last. If controller sends malformed sequence ISOSTA...

CVE-2026-72323 ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmpgqstarttimer A race condition exists between device teardown inetdevdestroy and incoming IGMP query processing igmprcv, leading to a Use-After-Free in the IGMP timer callback. During device...

CVE-2026-72298 net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtrendpointpost qrtrendpointpost validates an incoming packet with if !size || len != ALIGNsize, 4 + hdrlen goto err; where size comes from the wire. On 32-bit, sizet is 32 bits and...

CVE-2026-72280

CVE-2026-72280 concerns the Linux kernel KVM on arm64. The vulnerability arises from a logic issue where a guest could write to the ZCR_EL2 sysreg alias in a nested context if FEAT_NV2 is advertised to the L1 hypervisor. The fix is to drop the bogus WARN that could lead to a hyp_panic once hyp ve...

CVE-2026-72280 KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Drop bogus WARN for write to ZCREL2 It is entirely possible for a guest to write to the ZCREL2 sysreg alias while in a nested context, as it is expected if FEATNV2 is advertised to the L1 hypervisor. Get rid of th...