CVE-2026-72120 can: bcm: add missing rcu list annotations and operations

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu list annotations and operations sashiko-bot remarked the missing use of listaddrcu in bcmrx|txsetup to have a proper initialized bcmop structure when bcmprocshow traverses the bcmop's under rcureadlock. ...

EUVD-2026-59052

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-fence: Fix potential NULL pointer dereference The commit mentioned in the fixes tag below introduced a mechanism through which fence producers can fully decouple from fence consumers. This, desirable, mechanism is...

CVE-2026-72094

The CVE-2026-72094 entry describes a Linux kernel vulnerability in dma-buf: dma-fence where a race between the signaled-bit and the dma_fence_ops pointer could allow a NULL dereference on weakly ordered platforms. The fix decouples fence producers and consumers by using the signaled-bit as the de...

EUVD-2026-59029

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Fix use-after-free in usereventmmdup usereventmmdup walks the parent mm's enabler list locklessly under rcureadlock during fork from copyprocess; it does not take eventmutex: rcureadlock;...

CVE-2026-72071 tracing/user_events: Fix use-after-free in user_event_mm_dup()

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Fix use-after-free in usereventmmdup usereventmmdup walks the parent mm's enabler list locklessly under rcureadlock during fork from copyprocess; it does not take eventmutex: rcureadlock;...

CVE-2026-72072

The CVE-2026-72072 issue affects the Linux kernel’s mlx5e MACsec offload path. A use-after-free could occur when an offloaded MACsec RX SC is deleted: metadata_dst was freed unconditionally via metadata_dst_free(), ignoring the reference count, while readers could attach a freed dst to an skb dur...

CVE-2026-72071

The CVE-2026-72071 entry describes a Linux kernel issue in tracing/user_events where use-after-free can occur in user_event_mm_dup() during fork. The root cause is a lockless RCU walk of the parent mm enabler list (without taking event_mutex) followed by immediate free operations: user_event_put(...

EUVD-2026-59030

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadatadst on RX SC delete When an offloaded MACsec RX SC is deleted, macsecdelrxscctx freed the per-SC metadatadst with metadatadstfree, which kfrees the object unconditionally and ignor...

CVE-2026-72072 net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadatadst on RX SC delete When an offloaded MACsec RX SC is deleted, macsecdelrxscctx freed the per-SC metadatadst with metadatadstfree, which kfrees the object unconditionally and ignor...

CVE-2026-72072 net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadatadst on RX SC delete When an offloaded MACsec RX SC is deleted, macsecdelrxscctx freed the per-SC metadatadst with metadatadstfree, which kfrees the object unconditionally and ignor...

CVE-2026-72071 tracing/user_events: Fix use-after-free in user_event_mm_dup()

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Fix use-after-free in usereventmmdup usereventmmdup walks the parent mm's enabler list locklessly under rcureadlock during fork from copyprocess; it does not take eventmutex: rcureadlock;...

CVE-2026-72069 locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()

In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rtspinunlock rtspinunlock releases the RCU protection before unlocking the lock. That opens the door for the following UAF scenario: T1 T2 spinlock&p-lock; rcureadlock; invalidatep;...

EUVD-2026-59027

In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rtspinunlock rtspinunlock releases the RCU protection before unlocking the lock. That opens the door for the following UAF scenario: T1 T2 spinlock&p-lock; rcureadlock; invalidatep;...

CVE-2026-72069

Technical details for CVE-2026-72069 are not publicly provided in the supplied documents; monitor for updates.

CVE-2026-72069 locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()

In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rtspinunlock rtspinunlock releases the RCU protection before unlocking the lock. That opens the door for the following UAF scenario: T1 T2 spinlock&p-lock; rcureadlock; invalidatep;...

CVE-2026-72034 fhandle: reject detached mounts in capable_wrt_mount()

In the Linux kernel, the following vulnerability has been resolved: fhandle: reject detached mounts in capablewrtmount The recent fhandle RCU fix moved the mount namespace capability check into capablewrtmount, so a non-NULL mntnamespace survives the nscapable dereference. The helper still assume...

CVE-2026-72034 fhandle: reject detached mounts in capable_wrt_mount()

In the Linux kernel, the following vulnerability has been resolved: fhandle: reject detached mounts in capablewrtmount The recent fhandle RCU fix moved the mount namespace capability check into capablewrtmount, so a non-NULL mntnamespace survives the nscapable dereference. The helper still assume...

EUVD-2026-58982

In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local-interfaces under RCU. The bulk hardware teardown path removes entries with listdel, so an asynchronous transmit completion can...

CVE-2026-72024

CVE-2026-72024 concerns the Linux kernel’s mac802154 handling of interfaces under RCU. The issue arises when bulk teardown paths remove entries with list_del(), allowing an asynchronous transmit completion to follow a poisoned list node in ieee802154_wake_queue(). The root cause is the use of lis...

CVE-2026-72024 mac802154: remove interfaces with RCU list deletion

In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local-interfaces under RCU. The bulk hardware teardown path removes entries with listdel, so an asynchronous transmit completion can...