CVE-2026-72091

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...

CVE-2026-72090

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

CVE-2026-72088

The CVE-2026-72088 entry concerns the Linux kernel SCSI HPSA driver IOACCEL2 reset path. The root cause was a DMA mapping leak when phys_disk->in_reset is set, causing an early return without cleaning up resources allocated for the command. The fix adds proper error cleanup: unmapping the IOAC...

CVE-2026-72087

CVE-2026-72087 affects the Linux kernel SCSI LPFC driver, specifically the lpfc_sli4_driver_resource_setup() path. The vulnerability is a memory leak: memory allocated for mboxq via mempool_alloc() is not freed in some early exit error paths. The cited fixes relocate mempool_free() to an earlier ...

CVE-2026-72085

CVE-2026-72085 concerns the Linux kernel SCSI xen scsiback path. A path in scsiback_get_pend_req() creates a pending command with an uninitialized or not-yet-kref’d se_cmd; if a submission is aborted via a bad grant or unknown ring_req.act, transport_generic_free_cmd() underflows the reference co...

EUVD-2026-59042

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer corescsi3decodespeciport and corescsi3emulateregisterandmove hand the raw PERSISTENT RESERVE OUT parameter buffer to targetparseprouttransportid without tellin...

EUVD-2026-59040

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix refcount leak in efcthwioabort When efcthwreqtagalloc fails in efcthwioabort, the error path returns -ENOSPC without releasing the reference obtained via krefgetunlesszero earlier in the function. All other...

CVE-2026-72081 scsi: elx: efct: Fix I/O leak on unsupported additional CDB

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix I/O leak on unsupported additional CDB efctdispatchfcpcmd allocates an efctio before dispatching an unsolicited FCP command. If the command has an unsupported additional CDB, the function returns -EIO before...

CVE-2026-72075

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix race condition in resetdevice sysfs callback The imspcuresetdevice sysfs callback calls imspcuexecutecommand without acquiring pcu-cmdmutex. This can lead to data races and corruption of the shared command...

CVE-2026-72073

CVE-2026-72073 concerns the Linux kernel mmc/vub300 driver. The vulnerability arises from a use-after-free race on probe failure: the inactivity timer can be armed before mmc_add_host() completes, and if add_host() fails, a timer/deadwork path may still hold a kref, leading to the vub300 storage ...

CVE-2026-72069

Technical details for CVE-2026-72069 are not publicly provided in the supplied documents; monitor for updates.

CVE-2026-72066

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Bound hotplug states sysfs output statesshow adds CPU hotplug state names into a single sysfs buffer using sprintf. With enough registered states, this can write past the end of the PAGESIZE buffer. Use sysfsemitat ...

CVE-2026-72059

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure t7xxcldmalateinit creates mdctrl-gpddmapool before initializing the TX and RX rings. If any ring initialization fails, the error path frees the already initialized ring...

CVE-2026-72044

Removed by vendor...

CVE-2026-72026

In the Linux kernel, the following vulnerability has been resolved: irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure imsicearlyacpiinit allocates a firmware node before setting up the IMSIC state. If imsicsetupstate fails, the function returns without freeing the allocated...

CVE-2026-72019

In the Linux kernel, the following vulnerability has been resolved: macsec: don't read an unset MAC header in macsecencrypt macsecencrypt reads the Ethernet header via ethhdrskb skb-head + skb-macheader to memmove the 12 source/destination MAC bytes forward and make room for the SecTAG. On the...

CVE-2026-72017 net: macb: drop in-flight Tx SKBs on close

In the Linux kernel, the following vulnerability has been resolved: net: macb: drop in-flight Tx SKBs on close The MACB driver has since forever leaked the outgoing SKBs that have not yet been marked as completed. They live in queue-txskb which gets freed without remorse nor checking...

EUVD-2026-59111

In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Call synchronizercu when unregistering This ensures that any RCU readers traversing the instance list have finished, before releasing the reference on the tracer that the instance points to...

CVE-2026-68473

In the Linux kernel, the following vulnerability has been resolved: powerpc/uaccess: correct check for CONFIGPPCE500 in maskuseraddress maskuseraddress incorrectly checks for CONFIGE500 instead of CONFIGPPCE500, causing maskuseraddressisel to not be used on E500 hardware. Fix the check to use the...

CVE-2026-68455

In the Linux kernel, the following vulnerability has been resolved: liveupdate: validate session type before performing operation The sessions ioctls are not applicable to all session types. PRESERVEFD is only applicable to outgoing sessions. RETRIEVEFD and FINISH are only valid for incoming...