CVE-2026-72124

Summary: CVE-2026-72124 affects the Linux kernel CAN isotp TX state machine. The bug arose from mixing a lock-free cmpxchg() claim in sendmsg() with hrtimer_cancel() under so->rx_lock, creating windows where a frame or timer callback could operate on a migrated TX state and corrupt an unrelate...

CVE-2026-72124 can: isotp: serialize TX state transitions under so->rx_lock

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

CVE-2026-72124 can: isotp: serialize TX state transitions under so->rx_lock

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

CVE-2026-72067 cpu: hotplug: Preserve per instance callback errors

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhpinvokecallback unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the...

CVE-2026-72062

CVE-2026-72062 affects the Linux kernel GPIO path for mt7621, where bank-wide interrupt-trig state (rising/falling) could be corrupted by non-atomic read-modify-write updates when multiple IRQs on the same bank run concurrently. The issue arises because each gpio chip instance represents a 32-pin...

CVE-2026-72021

Summary: The CVE-2026-72021 issue affects the Linux kernel’s IPVS SCTP state lookup. The kernel incorrectly read the SCTP chunk header using a wrong offset for IPv6 when extension headers were present, causing misclassification of handshake steps (e.g., INIT1 vs ESTABLISHED) and incorrect managem...

CVE-2026-72021 ipvs: use parsed transport offset in SCTP state lookup

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

EUVD-2026-58979

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

CVE-2026-72021 ipvs: use parsed transport offset in SCTP state lookup

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

CVE-2026-68465 mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: fix esdhcchangepinstate to allow default state restore esdhcchangepinstate checks for pins100mhz and pins200mhz at the top of the function and returns -EINVAL if either is not defined. This prevents the...

EUVD-2026-59087

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: fix esdhcchangepinstate to allow default state restore esdhcchangepinstate checks for pins100mhz and pins200mhz at the top of the function and returns -EINVAL if either is not defined. This prevents the...

CVE-2026-68465

The CVE concerns the Linux kernel MMC subsystem (sdhci-esdhc-imx). The root cause was esdhc_change_pinstate() evaluating pins_100mhz/pins_200mhz at the top and returning -EINVAL if either is undefined, which could prevent the default pin configuration from being restored for devices with a sleep ...

CVE-2026-68465 mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: fix esdhcchangepinstate to allow default state restore esdhcchangepinstate checks for pins100mhz and pins200mhz at the top of the function and returns -EINVAL if either is not defined. This prevents the...

CVE-2026-72312: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix VF bringup affecting PF promiscuous state Mbox handling of nixsetrxmode for a VF with promiscuous and allmulti flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs...

CVE-2026-72021: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

PT-2026-72803

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ath12k mac vdev create function where three error path failures can leave the arvif state inconsistent. First, if ath12k wmi vdev create fails, the function return...

PT-2026-72177

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sdhci-esdhc-imx driver where the esdhc change pinstate function incorrectly validates pins 100mhz and pins 200mhz at the start of the function. By returning -EINVA...

CVE-2026-72124: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

PT-2026-72313

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ISO Transport Protocol ISOTP implementation of the CAN subsystem. The TX state machine, managed by the variable so-tx.state, is driven by sendmsg, the RX path for...

PT-2026-72251

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7621 GPIO driver where bank-shared fields, specifically rising and falling, are modified using non-atomic read-modify-write operations. Because each GPIO chip...