CVE-2026-72410

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Validate NIX maximum LFs correctly NIX maximum number of LFs can be set via devlink command but that can be done before assigning any LFs to a PF/VF. The condition used to check whether any LFs are assigned is...

CVE-2026-72408

In the Linux kernel, the following vulnerability has been resolved: geneve: gate GRO hint in genevegrocomplete on gs-grohint genevegroreceive reads the GRO hint through geneveskgrohintoff, which honours it only when the socket enabled IFLAGENEVEGROHINT gs-grohint. genevegrocomplete instead calls...

CVE-2026-72407

In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in genevegrocomplete Even with both paths gated on gs-grohint, genevegrocomplete re-derives the inner dispatch type and length from the packet and the current gs-grohint, independently of...

CVE-2026-72406

In the Linux kernel, the following vulnerability has been resolved: net: sungem: fix probe error cleanup geminitone calls gemremoveone when registernetdev fails. gemremoveone unregisters and frees resources owned by the netdevice, including the DMA block, MMIO mapping, PCI regions, and the...

CVE-2026-72404

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in cleanupbearer due to premature dstcachedestroy TIPC UDP media bearer teardown calls dstcachedestroy on its replicast caches before calling synchronizenet to wait for concurrent RCU readers transmitters to finish:...

CVE-2026-72403

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcpfindfcinterface currently selects the first vendor-specific interface...

CVE-2026-72401

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insnauxdata leak on verifier errfreeenv path When bpfcheck allocates env-insnauxdata successfully but later fails to allocate env-succ, it jumps directly to errfreeenv. The existing vfreeenv-insnauxdata sits before the...

CVE-2026-72402

In the Linux kernel, the following vulnerability has been resolved: bpf: Mask pseudo pointer values in verifier logs printbpfinsn masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPFPSEUDOMAPFD and BPFPSEUDOMAPVALUE...

CVE-2026-72400

In the Linux kernel, the following vulnerability has been resolved: seg6: validate SRH length before reading fixed fields seg6validatesrh reads fixed SRH fields such as srh-type and srh-hdrlen before checking that the supplied length covers the fixed struct ipv6srhdr fields. The BPF SEG6 encap pa...

CVE-2026-72391

In the Linux kernel, the following vulnerability has been resolved: net: phy: sfp: free miibus in sfpi2cmdiobusdestroy sfpi2cmdiobuscreate allocates the I2C MDIO bus with mdioi2calloc, a plain non-devm allocation, and registers it. sfpi2cmdiobusdestroy only unregisters the bus and clears sfp-i2cm...

CVE-2026-72390

In the Linux kernel, the following vulnerability has been resolved: net/sched: schteql: Introduce slaveslock to avoid race condition and UAF The teql master-slaves singly linked list is not protected against multiple writes. It can be mod'ed concurently from teqlmasterxmit, teqldequeue, teqlinit...

CVE-2026-72387

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix potential invalid pointer deref in groupprocesstileroom If heaps is an ERRPTR, panthorheappoolput will deref an invalid pointer. Make sure we set it to NULL in that case...

CVE-2026-72386

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced A group ref is tied to the pending tileroomwork, so we need to release it if the cancel was effective...

CVE-2026-72382

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

CVE-2026-72381

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistentid race the fp-owner.name compare-read in ksmbdvfscomparedurableowner against the kfr...

CVE-2026-72378

In the Linux kernel, the following vulnerability has been resolved: afs: Fix error code in afsextractvladdrs The error codes on these paths are only set on the first iteration through the loop. Set the correct error code on every iteration...

CVE-2026-72374

In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incomi...

CVE-2026-72373

In the Linux kernel, the following vulnerability has been resolved: afs: Fix missing NULL pointer check in afsbreaksomecallbacks Fix afsbreaksomecallbacks to check to see if afslookupvolumercu returned NULL e.g. the specified volume is unknown...

CVE-2026-72371

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFSVOLUMERMTREE is set on Fix afsinsertvolumeintocell to set AFSVOLUMERMTREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volume to be...

CVE-2026-72370

In the Linux kernel, the following vulnerability has been resolved: iomap: release pages on atomic dio size mismatch If bioiovitergetpages or the bounce helper succeeds but builds a short bio, the REQATOMIC size check rejects it before submission. The old error path only dropped the bio reference...