CVE-2026-72370 iomap: release pages on atomic dio size mismatch

In the Linux kernel, the following vulnerability has been resolved: iomap: release pages on atomic dio size mismatch If bioiovitergetpages or the bounce helper succeeds but builds a short bio, the REQATOMIC size check rejects it before submission. The old error path only dropped the bio reference...

CVE-2026-72305 VDUSE: avoid leaking information to userspace

In the Linux kernel, the following vulnerability has been resolved: VDUSE: avoid leaking information to userspace The bounceing is not necessarily page aligned, so current VDUSE can leak kernel information through mapping bounce pages to userspace. Allocate bounce pages with GFPZERO to avoid...

CVE-2026-72305

Consolidated details show CVE-2026-72305 affects the Linux kernel VDUSE subsystem, where bounce pages mapped to userspace may leak kernel information due to non-page-aligned bounce handling. Mitigation: allocate bounce pages with __GFP_ZERO to prevent leaking data to userspace. The vulnerability ...

CVE-2026-72305 VDUSE: avoid leaking information to userspace

In the Linux kernel, the following vulnerability has been resolved: VDUSE: avoid leaking information to userspace The bounceing is not necessarily page aligned, so current VDUSE can leak kernel information through mapping bounce pages to userspace. Allocate bounce pages with GFPZERO to avoid...

EUVD-2026-59204

In the Linux kernel, the following vulnerability has been resolved: VDUSE: avoid leaking information to userspace The bounceing is not necessarily page aligned, so current VDUSE can leak kernel information through mapping bounce pages to userspace. Allocate bounce pages with GFPZERO to avoid...

PT-2026-72493

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in VDUSE where kernel information can be leaked to userspace. This occurs because bouncing is not necessarily page aligned, allowing the mapping of bounce pages to...

Linux Distros Unpatched Vulnerability : CVE-2026-72305

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - VDUSE: avoid leaking information to userspace The bounceing is not necessarily page aligned, so current VDUSE can leak kernel information through mapping bounce...

CVE-2026-72305: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: VDUSE: avoid leaking information to userspace The bounceing is not necessarily page aligned, so current VDUSE can leak kernel information through mapping bounce pages to userspace. Allocate bounce pages with GFPZERO to avoid...

CVE-2026-73481

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint bouncerules.php / bouncerule.php. The deletion is performed via a GET request ?page=bouncerules&del=N, and the central CSRF check verifyCsrfGetToken is invoked with enforce=false, so it only...

CVE-2026-73481 phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint bouncerules.php / bouncerule.php. The deletion is performed via a GET request ?page=bouncerules&del=N, and the central CSRF check verifyCsrfGetToken is invoked with enforce=false, so it only...

CVE-2026-73481 phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint bouncerules.php / bouncerule.php. The deletion is performed via a GET request ?page=bouncerules&del=N, and the central CSRF check verifyCsrfGetToken is invoked with enforce=false, so it only...

CVE-2026-73481

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint bouncerules.php / bouncerule.php. The deletion is performed via a GET request ?page=bouncerules&del=N, and the central CSRF check verifyCsrfGetToken is invoked with enforce=false, so it only...

EUVD-2026-58228

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint bouncerules.php / bouncerule.php. The deletion is performed via a GET request ?page=bouncerules&del=N, and the central CSRF check verifyCsrfGetToken is invoked with enforce=false, so it only...

CVE-2026-73481

CVE-2026-73481 affects phpList

CVE-2026-73481 phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint bouncerules.php / bouncerule.php. The deletion is performed via a GET request ?page=bouncerules&del=N, and the central CSRF check verifyCsrfGetToken is invoked with enforce=false, so it only...

PT-2026-71732

Name of the Vulnerable Software and Affected Versions phpList versions prior to 3.7.0-RC5 Description Cross-Site Request Forgery CSRF occurs because the application fails to enforce token validation on the bounce rule deletion endpoints 'bouncerules.php' and 'bouncerule.php'. The deletion process...

CVE-2026-11743

The SF32LB MPI QSPI NOR flash driver drivers/flash/flashsf32lbmpiqspinor.c validated the flash offset and length on its read and write paths with the test offset + size data-size. Because offset is a signed offt while size is unsigned, a negative offset is converted to a large unsigned value and...

CVE-2026-11743 Missing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and write

The SF32LB MPI QSPI NOR flash driver drivers/flash/flashsf32lbmpiqspinor.c validated the flash offset and length on its read and write paths with the test offset + size data-size. Because offset is a signed offt while size is unsigned, a negative offset is converted to a large unsigned value and...

CVE-2026-11743

The CVE concerns the SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c). The vulnerability arises in the read/write paths where a signed offset (off_t) is compared against an unsigned size using (offset + size) &gt; data-&gt;size, allowing a negative offset to wrap to a ...

CVE-2026-11743 Missing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and write

The SF32LB MPI QSPI NOR flash driver drivers/flash/flashsf32lbmpiqspinor.c validated the flash offset and length on its read and write paths with the test offset + size data-size. Because offset is a signed offt while size is unsigned, a negative offset is converted to a large unsigned value and...