EUVD-2026-59179

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Drop bogus WARN for write to ZCREL2 It is entirely possible for a guest to write to the ZCREL2 sysreg alias while in a nested context, as it is expected if FEATNV2 is advertised to the L1 hypervisor. Get rid of th...

CVE-2026-72270

In the Linux kernel, the following vulnerability has been resolved: fbdev: s3fb: fix potential memory leak in s3pciprobe In s3pciprobe, the memory allocated for modelist using fbvideomodetomodelist is not freed in subsequent error paths. Fix that by calling fbdestroymodelist...

EUVD-2026-58952

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indxfindbuffer to prevent stack overflow indxfindbuffer recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded recursion,...

CVE-2026-72194

The CVE-2026-72194 issue affects the Linux kernel’s ntfs3 implementation. A depth-unlimited recursion in indx_find_buffer() when traversing the NTFS B+ tree can be triggered by mounting a malicious NTFS image and deleting a file whose index entry engages the rebalancing path, potentially causing ...

CVE-2026-72191 ntfs3: validate split-point offset in indx_insert_into_buffer

In the Linux kernel, the following vulnerability has been resolved: ntfs3: validate split-point offset in indxinsertintobuffer indxinsertintobuffer computes used = used1 - tocopy - spsize; memmovedet, Add2Ptrsp, spsize, used - le32tocpuhdr1-deoff; where sp and spsize come from hdrfindsplit...

CVE-2026-72191 ntfs3: validate split-point offset in indx_insert_into_buffer

In the Linux kernel, the following vulnerability has been resolved: ntfs3: validate split-point offset in indxinsertintobuffer indxinsertintobuffer computes used = used1 - tocopy - spsize; memmovedet, Add2Ptrsp, spsize, used - le32tocpuhdr1-deoff; where sp and spsize come from hdrfindsplit...

CVE-2026-72186

In the Linux kernel, the following vulnerability has been resolved: ntfs: make system files immutable to prevent corruption When a system file such as $Bitmap is exposed via showsysfiles and written from userspace, the volume is corrupted and, because the cluster allocator scans $Bitmap through t...

CVE-2026-72179

In the Linux kernel, the following vulnerability has been resolved: riscv: cacheinfo: Fix node reference leak in populatecacheleaves Currently, the while loop drops the reference to prev in each iteration. If the loop terminates early due to a break, the final ofnodeputnp correctly drops the...

CVE-2026-72176

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: put stats for schemeadddirs internal error damonsysfsschemeadddirs setup the triedregions directory after the stats directory setup is completed. When the triedregions directory setup is failed, the setup...

CVE-2026-72163

The vulnerability CVE-2026-72163 affects the Linux kernel OCFS2 journaling path. The issue arises in ocfs2_assure_trans_credits: when a journal aborts during DIO completion, a NULL h_transaction dereference can occur because the handle’s aborted state isn’t checked before reading remaining credit...

CVE-2026-72162

CVE-2026-72162 — In the Linux kernel OCFS2 code, a UBSAN array-index-out-of-bounds flaw occurs in ocfs2_sum_rightmost_rec when l_next_free_rec is 0 or exceeds l_count, indexing l_recs[] out of bounds. The root cause is computing i = le16_to_cpu(el->l_next_free_rec) - 1 without validating i. Th...

EUVD-2026-58920

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2sumrightmostrec BUG On-disk corruption setting lnextfreerec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. CAUSE...

CVE-2026-72161 ocfs2: add journal NULL check in ocfs2_checkpoint_inode()

In the Linux kernel, the following vulnerability has been resolved: ocfs2: add journal NULL check in ocfs2checkpointinode During unmount, ocfs2journalshutdown frees the journal and sets osb-journal to NULL. Later, when VFS evicts remaining cached inodes, ocfs2evictinode - ocfs2clearinode -...

CVE-2026-72150 sunrpc: fix uninitialized xprt_create_args structure

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix uninitialized xprtcreateargs structure The xprtcreateargs structure is allocated on the stack without initialization in rpcsysfsxprtswitchaddxprtstore. While some fields are manually populated, critical fields like...

CVE-2026-72150

The CVE-2026-72150 issue affects the Linux kernel sunrpc subsystem. The xprt_create_args structure was allocated on the stack without initialization in rpc_sysfs_xprt_switch_add_xprt_store(), leaving fields such as srcaddr, bc_xps, and flags with garbage data. This can cause kernel panic when xs_...

CVE-2026-72150 sunrpc: fix uninitialized xprt_create_args structure

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix uninitialized xprtcreateargs structure The xprtcreateargs structure is allocated on the stack without initialization in rpcsysfsxprtswitchaddxprtstore. While some fields are manually populated, critical fields like...

EUVD-2026-58908

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix uninitialized xprtcreateargs structure The xprtcreateargs structure is allocated on the stack without initialization in rpcsysfsxprtswitchaddxprtstore. While some fields are manually populated, critical fields like...

EUVD-2026-58905

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma-pcie: Reject devices without driver data dwedmapcieprobe treats the PCI device ID driverdata as the template for the controller layout and copies it unconditionally. A device bound dynamically via sysfs can mat...

CVE-2026-72036 net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

In the Linux kernel, the following vulnerability has been resolved: net/sched: schmultiq: Replace direct dequeue call with peek and qdiscdequeuepeeked multiqdequeue takes a packet from a band's child with a direct -dequeue call after multiqpeek peeked it. When the child is non-work-conserving the...

CVE-2026-72036 net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

In the Linux kernel, the following vulnerability has been resolved: net/sched: schmultiq: Replace direct dequeue call with peek and qdiscdequeuepeeked multiqdequeue takes a packet from a band's child with a direct -dequeue call after multiqpeek peeked it. When the child is non-work-conserving the...