CVE-2026-72307

A flaw was found in the Linux kernel's mlxsw driver. When the mlxswspvrslpmtreereplace function encounters an error during Virtual Router VR replacement operations, its rollback mechanism fails to correctly release resources. This leads to a reference count leak, where system resources are not...

CVE-2026-72067

A flaw was found in the Linux kernel's CPU hotplug mechanism. When the cpuhpinvokecallback function attempts to unwind previous operations after a failure, it can incorrectly reuse a return value. This issue allows a successful rollback to mask the original error, causing a failed CPU hotplug...

Important: kernel6.18

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix race condition during PASID entry replacement CVE-2026-45945 In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix missing run load for vcn0 in attrdatagetblocklocked...

CVE-2026-72496

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Proper rollback if the ioremap fails bnxtqpliballocdpi returns success even if ioremap fails. Add the proper rollback when the ioremap fails and return -ENOMEM status...

AZL-96099 CVE-2026-72496 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Proper rollback if the ioremap fails bnxtqpliballocdpi returns success even if ioremap fails. Add the proper rollback when the ioremap fails and return -ENOMEM status...

CVE-2026-72345

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback On failure at index i, the reverse cleanup loop in mlx5lagcreatesinglefdb starts from i, so the failed index itself is rolled back. That can operate on uninitialized stat...

CVE-2026-72307

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspvrslpmtreereplace When mlxswspvrslpmtreereplace fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but...

CVE-2026-72496

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Proper rollback if the ioremap fails bnxtqpliballocdpi returns success even if ioremap fails. Add the proper rollback when the ioremap fails and return -ENOMEM status...

CVE-2026-72307

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspvrslpmtreereplace When mlxswspvrslpmtreereplace fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but...

UBUNTU-CVE-2026-74397

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5iballoctransportdomain allocates a transport domain and then may fail in mlx5ibenablelb. In that case, the allocated TD is leaked. Fix this by deallocatin...

UBUNTU-CVE-2026-72496

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Proper rollback if the ioremap fails bnxtqpliballocdpi returns success even if ioremap fails. Add the proper rollback when the ioremap fails and return -ENOMEM status...

UBUNTU-CVE-2026-72307

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspvrslpmtreereplace When mlxswspvrslpmtreereplace fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but...

CVE-2026-72345

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback On failure at index i, the reverse cleanup loop in mlx5lagcreatesinglefdb starts from i, so the failed index itself is rolled back. That can operate on uninitialized stat...

CVE-2026-72067

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhpinvokecallback unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the...

CVE-2026-72067

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhpinvokecallback unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the...

UBUNTU-CVE-2026-72067

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhpinvokecallback unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the...

CVE-2026-74397

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5iballoctransportdomain allocates a transport domain and then may fail in mlx5ibenablelb. In that case, the allocated TD is leaked. Fix this by deallocatin...

CVE-2026-74382

CVE-2026-74382 concerns a stack overflow in the Linux kernel’s net/sched cls_bpf offload rollback. The issue arises when cls_bpf_offload_cmd() recursively re-enters during rollback if tc_setup_cb_replace() fails twice in a row, allowing unbounded recursion until the stack is exhausted. Two propos...

CVE-2026-74382 net/sched: cls_bpf: prevent unbounded recursion in offload rollback

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: prevent unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in clsbpfoffloadcmd. Reproducer on netdevsim: add a skipsw clsbpf filter, set the bpftcaccept debugfs knob to 0, then tc filt...

CVE-2026-74382

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: prevent unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in clsbpfoffloadcmd. Reproducer on netdevsim: add a skipsw clsbpf filter, set the bpftcaccept debugfs knob to 0, then tc filt...