CVE-2026-72173

In the Linux kernel, the following vulnerability has been resolved: fs/proc/taskmmu: do not warn on seeing non-migration pmd entry Patch series "mm/hmm: A fix and a selftest", v3. Patch 1 fixes a stale warning present from the time when only migration softleaf entries were supported at the PMD...

CVE-2026-72171

In the Linux kernel, the following vulnerability has been resolved: mtd: slram: remove failed entries from the device list registerdevice links a new slrammtdlist entry before allocating all of the state needed by the entry. If a later allocation, memremap, or mtddeviceregister fails, the partial...

CVE-2026-72172

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: fix uninitialized struct pages for ZONEDEVICE If DAX memory is hotplugged into an unoccupied subsection of an early section, sectionactivate reuses the unoptimized boot memmap. However, compoundnrpages still assumes th...

CVE-2026-72170

In the Linux kernel, the following vulnerability has been resolved: 9p: skip nlink update in cacheless mode to fix WARNON v9fsdeccount unconditionally calls dropnlink on regular files, even when the inode's nlink is already zero. In cacheless mode the client refetches inode metadata from the serv...

CVE-2026-72169

In the Linux kernel, the following vulnerability has been resolved: kho: make sure scratch size is always aligned by CMAMINALIGNMENTBYTES When using scratchscale, the scratch sizes are rounded up to CMAMINALIGNMENTBYTES since they will be released as MIGRATECMA. This is not done when using fixed...

CVE-2026-72168

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix fault in unaligned fixup Use kzallocobj / kzallocobjs to allocate the memcard structs, instead of kmallocobj / kmallocobjs to prevent access to uninitialized data. Fixes runtime error: Fault in unaligned...

CVE-2026-72167

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: pl353: fix probe resource allocation During probe, the devmioremap is called with the parent device instead of the current one. So when the module is unloaded, the register area isn't released. Target the pl35x devi...

CVE-2026-72166

In the Linux kernel, the following vulnerability has been resolved: net/9p: fix infinite loop in p9clientrpc on fatal signal When p9clientrpc is called with type P9TFLUSH and the transport has no peer e.g. fd transport backed by pipes with no 9p server, a fatal signal causes an infinite loop:...

CVE-2026-72165

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix condition in 'nandselecttarget' 'cs' here must be in range 0:nanddevntargets...

CVE-2026-72163

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL htransaction deref in ocfs2assuretranscredits BUG A direct write over unwritten extents can panic the kernel in ocfs2assuretranscredits when the journal aborts during DIO completion. The crash is a general...

CVE-2026-72162

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2sumrightmostrec BUG On-disk corruption setting lnextfreerec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. CAUSE...

CVE-2026-72161

In the Linux kernel, the following vulnerability has been resolved: ocfs2: add journal NULL check in ocfs2checkpointinode During unmount, ocfs2journalshutdown frees the journal and sets osb-journal to NULL. Later, when VFS evicts remaining cached inodes, ocfs2evictinode - ocfs2clearinode -...

CVE-2026-72159

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject non-inline dinodes with isize and zero iclusters On a volume mounted without OCFS2FEATUREINCOMPATSPARSEALLOC, a non-inline regular file with non-zero isize and zero iclusters is structurally malformed: the extent ma...

CVE-2026-72160

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject dinodes with non-canonical imode type Patch series "ocfs2: harden inode validators against forged metadata", v2. This series adds three structural checks to OCFS2 dinode validation so malformed on-disk fields are...

CVE-2026-72158

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: add bounds check in dfhgetparamsize dfhgetparamsize can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP End of Parameters bit is se...

CVE-2026-72157

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags overflow by bounding framecount tbnetpoll assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment...

CVE-2026-72156

In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero headersize OOB read in mpfopsparseheader mpfopsparseheader reads headersize from the bitstream at MPFHEADERSIZEOFFSET 24. When headersize is zero, the expression buf + headersize - 1 reads one byte...

CVE-2026-72155

In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: swp: Improve locking user experience In the case of the first block being locked or the few first blocks, if the user want to fully unlock the device it has two possibilities: - either it asks to unlock the entire...

CVE-2026-72154

In the Linux kernel, the following vulnerability has been resolved: openrisc: Fix jumplabel smp syncing The original commit 8c30b0018f9d "openrisc: Add jump label support" copies from arm64 and does not properly consider how icache invalidation on remote cores works in OpenRISC. On OpenRISC remot...

CVE-2026-72151

In the Linux kernel, the following vulnerability has been resolved: tpm: tpm2-sessions: wait for async KPP completion in tpmbufappendsalt tpmbufappendsalt in drivers/char/tpm/tpm2-sessions.c calls cryptokppgeneratepublickey and cryptokppcomputesharedsecret without installing a completion callback...