CVE-2026-72313

In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: Only consider active CRTCs for vblank sync Only synchronize fbdev output to the vblank of an active CRTC. Go over the list of CRTCs and pick the first that matches. Fixes warnings as the one shown below 77.201354...

CVE-2026-72312

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix VF bringup affecting PF promiscuous state Mbox handling of nixsetrxmode for a VF with promiscuous and allmulti flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs...

CVE-2026-72311

In the Linux kernel, the following vulnerability has been resolved: drm/xe: free madvise VMA array on L2 flush failure xevmmadviseioctl allocates madviserange.vmas in getvmas. After getvmas succeeds with at least one VMA, error paths must go through freevmas so the array is released before the...

CVE-2026-72310

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2ioctlqueryinfo validates the PASSTHRUFSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bounds...

CVE-2026-72308

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspportlagjoin When mlxswspportlagindexget fails, mlxswspportlagjoin returns an error without releasing the lag reference obtained by the earlier mlxswsplagget. All other error paths in the functio...

CVE-2026-72309

In the Linux kernel, the following vulnerability has been resolved: tracing/remotes: Fix leak in traceremoteallocbuffer error path If page allocation fails in traceremoteallocbuffer, desc-nrcpus is not yet incremented for the current CPU. As a consequence, on error, half-allocated rbdesc will not...

CVE-2026-72307

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspvrslpmtreereplace When mlxswspvrslpmtreereplace fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but...

CVE-2026-72306

In the Linux kernel, the following vulnerability has been resolved: vduse: Fix race in vdusedevmsgsync and vdusedevreaditer There is one race case in vdusedevmsgsync and vdusedevreaditer: vdusedevreaditer: lockmsglock; dequeuemsgsendlist; unlockmsglock; vdusedevmsgsync: waittimeout finish...

CVE-2026-72305

In the Linux kernel, the following vulnerability has been resolved: VDUSE: avoid leaking information to userspace The bounceing is not necessarily page aligned, so current VDUSE can leak kernel information through mapping bounce pages to userspace. Allocate bounce pages with GFPZERO to avoid...

CVE-2026-72304

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Fix TOCTOU in sofipc4bytesput In sofipc4bytesput, the copy size is derived from the old data-size in the buffer rather than the incoming new data's size field from ucontrol. If the new data has a differen...

CVE-2026-72302

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Use overflow checks in controlupdate size calc In sofipc3controlupdate, the expectedsize calculation uses firmware-provided cdata-numelems in arithmetic that could overflow on 32-bit platforms, wrapping t...

CVE-2026-72301

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix TOCTOU in bytesput and bytesget In sofipc3bytesput, the size used for the memcpy is derived from the old data-size already in the buffer, not the incoming new data's size field. If the new data has a...

CVE-2026-72299

In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tracepoints tipcskenqueue runs with sk-sklock.slock held while the socket is owned by user context. The spinlock protects the backlog queue in this path, but it does not serialize...

CVE-2026-72300

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

CVE-2026-72298

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtrendpointpost qrtrendpointpost validates an incoming packet with if !size || len != ALIGNsize, 4 + hdrlen goto err; where size comes from the wire. On 32-bit, sizet is 32 bits and...

CVE-2026-72297

In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation Reject ATM traffic classes above ATMANYCLASS in checktp. SOATMQOS stores the supplied QoS after checkqos succeeds, so accepting larger values leaves invalid...

CVE-2026-72296

In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETHHLEN to be pullable in ifedecode ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes the decapsulated packet to ethtypetrans, which expects the inner...

CVE-2026-72295

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate irqchip index in irqfd routing Sashiko reported that the irqchip index is not validated for LoongArch. Add validation and reject out-of-range irqchip indexes to avoid indexing past the routing table's chi...

CVE-2026-72294

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Check irq validity in kvmvcpuioctlinterrupt Function kvmvcpuioctlinterrupt can be called from userspace, here add irq validility cheking in kvmvcpuioctlinterrupt...

CVE-2026-72293

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: Add missing radixtreepreload in gaccessshadowfault Add missing radixtreepreload in gaccessshadowfault to guarantee forward progress. The core of gaccessshadowfault has been split into gaccessshadowfault in order ...