CVE-2026-72312

CVE-2026-72312 affects the Linux kernel component octeontx2-af and fixes an issue where VF bringup could erroneously modify the PF’s promiscuous/allmulti MCAM rules. The root cause was that mbox handling of nix_set_rx_mode (and related APIs) acted only on the PF, not the VF, potentially clearing ...

CVE-2026-72256 netfilter: xt_cluster: reject template conntracks in hash match

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This causes a state confusion bug when the raw table C...

EUVD-2026-59155

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This causes a state confusion bug when the raw table C...

EUVD-2026-59151

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nftpipapomatch can enter a bad state: - some fields can have their lookup tables resized while others did not - bits...

CVE-2026-72252 netfilter: nft_set_pipapo: don't leak bad clone into future transaction

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nftpipapomatch can enter a bad state: - some fields can have their lookup tables resized while others did not - bits...

EUVD-2026-58960

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid heap allocation for free-cluster readahead state getnrfreeclusters allocates a temporary filerastate before it publishes the precomputed free cluster count, sets NVolFreeClusterKnown, and wakes vol-freewaitq. If that...

CVE-2026-72202

Technical details are not publicly available in the provided documents. Monitor for updates from vendors and security trackers for affected products, patches, and remediation status.

CVE-2026-72202 ntfs: avoid heap allocation for free-cluster readahead state

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid heap allocation for free-cluster readahead state getnrfreeclusters allocates a temporary filerastate before it publishes the precomputed free cluster count, sets NVolFreeClusterKnown, and wakes vol-freewaitq. If that...

CVE-2026-72152 tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()

In the Linux kernel, the following vulnerability has been resolved: tpm: tpmtisspi: Use waitwoken in waitfortmpstat waiteventinterruptibletimeout evaluates its condition after setting the current task state to TASKINTERRUPTIBLE. With CONFIGDEBUGATOMICSLEEP this triggers a warning when the IRQ wai...

EUVD-2026-58899

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 IRQ SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next...

EUVD-2026-58882

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

CVE-2026-72124

Summary: CVE-2026-72124 affects the Linux kernel CAN isotp TX state machine. The bug arose from mixing a lock-free cmpxchg() claim in sendmsg() with hrtimer_cancel() under so->rx_lock, creating windows where a frame or timer callback could operate on a migrated TX state and corrupt an unrelate...

CVE-2026-72124 can: isotp: serialize TX state transitions under so->rx_lock

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

CVE-2026-72124 can: isotp: serialize TX state transitions under so->rx_lock

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

CVE-2026-72067 cpu: hotplug: Preserve per instance callback errors

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhpinvokecallback unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the...

CVE-2026-72062

CVE-2026-72062 affects the Linux kernel GPIO path for mt7621, where bank-wide interrupt-trig state (rising/falling) could be corrupted by non-atomic read-modify-write updates when multiple IRQs on the same bank run concurrently. The issue arises because each gpio chip instance represents a 32-pin...

CVE-2026-72021

Summary: The CVE-2026-72021 issue affects the Linux kernel’s IPVS SCTP state lookup. The kernel incorrectly read the SCTP chunk header using a wrong offset for IPv6 when extension headers were present, causing misclassification of handshake steps (e.g., INIT1 vs ESTABLISHED) and incorrect managem...

CVE-2026-72021 ipvs: use parsed transport offset in SCTP state lookup

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

EUVD-2026-58979

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

CVE-2026-72021 ipvs: use parsed transport offset in SCTP state lookup

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...