CVE-2026-72345

CVE-2026-72345 affects the Linux kernel mlx5 LAG handling. The vulnerability arises in the single-FDB error rollback: on failure at index i, the reverse cleanup loop in mlx5_lag_create_single_fdb() starts from i, risking rollback of the failed index or double-tearing down a rule already self-roll...

CVE-2026-72307 mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspvrslpmtreereplace When mlxswspvrslpmtreereplace fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but...

CVE-2026-72307

CVE-2026-72307 describes a Linux kernel issue in the mlxsw path where, after replacing VRs, the error rollback loop failed to update the vr pointer, causing a refcount leak of new_tree if replacements were partially completed. The root cause: the loop variable could point at the wrong VR, causing...

EUVD-2026-59206

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspvrslpmtreereplace When mlxswspvrslpmtreereplace fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but...

CVE-2026-72307 mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspvrslpmtreereplace When mlxswspvrslpmtreereplace fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but...

CVE-2026-72067 cpu: hotplug: Preserve per instance callback errors

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhpinvokecallback unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the...

CVE-2026-72067 cpu: hotplug: Preserve per instance callback errors

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhpinvokecallback unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the...

PT-2026-72684

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt re: Proper rollback if the ioremap fails bnxt qplib alloc dpi returns success even if ioremap fails. Add the proper rollback when the ioremap fails and return -ENOMEM status...

PT-2026-72833

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5 ib alloc transport domain allocates a transport domain and then may fail in mlx5 ib enable lb. In that case, the allocated TD is leaked. Fix this by...

PT-2026-72818

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls bpf: prevent unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in cls bpf offload cmd. Reproducer on netdevsim: add a skip sw cls bpf filter, set the bpf tc accept debugfs knob to 0, then...

PT-2026-72495

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw sp vrs lpm tree replace When mlxsw sp vrs lpm tree replace fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the...

PT-2026-72533

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback On failure at index i, the reverse cleanup loop in mlx5 lag create single fdb starts from i, so the failed index itself is rolled back. That can operate on uninitialized...

Linux Distros Unpatched Vulnerability : CVE-2026-72496

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/bnxtre: Proper rollback if the ioremap fails bnxtqpliballocdpi returns success even if ioremap fails. Add the proper rollback when the ioremap fails and...

PT-2026-72256

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhp invoke callback unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the...

CVE-2026-68116

CVE-2026-68116 affects the Linux kernel VXLAN MDB replacement path. When replacing the source list of an MDB remote entry, the old sources are marked for deletion and the new list is added; if vxlan_mdb_remote_srcs_add() fails partway, the original rollback could delete pre-existing sources along...

CVE-2026-68116 vxlan: mdb: Fix source list corruption on a failed replace

In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix source list corruption on a failed replace When replacing the source list of an MDB remote entry, all existing sources are first marked for deletion and vxlanmdbremotesrcsadd is then called to add the new source...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: net/mlx5e: Fixed the crash that occurred during profile change rollback failure. The mlx5enetdevchangeprofile function may fail to attach a new profile and may fail to roll back to the old profile. In such cases, we might end ...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: octeonep VF: Fixed the issue where the devid used in the freeirq function did not match the original devid during the IRQ rollback process. The octepvfrequestirqs function requests MSI-X queues of IRQs with a devid set to...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: hns3 – Fixed the double-free issue with the tx spare buffer. In the function hns3setringparam, a temporary copy of the ring structure tmprings is created for rollback purposes. However, the txspare pointer in the original ri...

UBUNTU-CVE-2026-64390

In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths,...