CVE-2026-72285 KVM: TDX: Reject concurrent change to CPUID entry count

In the Linux kernel, the following vulnerability has been resolved: KVM: TDX: Reject concurrent change to CPUID entry count Reject KVMTDXINITVM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data. tdxtdinit first reads userdata-cpuid.nent to...

CVE-2026-72232

CVE-2026-72232 relates to the Linux kernel/batman-adv stack, where a local user with eBPF TC hook access could trigger a packet truncation that redirects to a batman-adv interface. The vulnerability arises because the code assumes at least ETH_HLEN bytes are available and may read beyond the buff...

CVE-2026-72232 batman-adv: ensure minimal ethernet header on TX

In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 "net: bridge: xmit: make sure we have at least eth header len bytes", it is possible by for a local user with eBPF TC hook access to attach a t...

EUVD-2026-58968

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one in mapping pairs decoding bounds checks In ntfsmappingpairsdecompress, attrend points one byte past the end of the attribute record: attrend = u8 attr + le32tocpuattr-length; The two bounds checks validating...

EUVD-2026-58966

In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfsealookup and ntfslistxattr, this verifies that there is enough space in the EA entry before accessing the nextentryoffset field of the EA entry...

CVE-2026-72129

The CVE describes a Linux kernel nvmet-rdma issue: when inline_data_size exceeds PAGE_SIZE, an offset in (PAGE_SIZE, inline_data_size] causes PAGE_SIZE - off to underflow, making sg->length effectively 4 GiB and allowing reading past the first inline page. The root cause is that the mapping as...

EUVD-2026-59047

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fwlogfrombo validates the tracing buffer headersize and that the log fits within the BO, but never checks that log-size is at least log-headersize. fwlogprintbuffer th...

CVE-2026-72089 accel/ivpu: Reject firmware log with size smaller than header

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fwlogfrombo validates the tracing buffer headersize and that the log fits within the BO, but never checks that log-size is at least log-headersize. fwlogprintbuffer th...

CVE-2026-72084 scsi: target: Bound PR-OUT TransportID parsing to the received buffer

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer corescsi3decodespeciport and corescsi3emulateregisterandmove hand the raw PERSISTENT RESERVE OUT parameter buffer to targetparseprouttransportid without tellin...

EUVD-2026-59042

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer corescsi3decodespeciport and corescsi3emulateregisterandmove hand the raw PERSISTENT RESERVE OUT parameter buffer to targetparseprouttransportid without tellin...

CVE-2026-72084 scsi: target: Bound PR-OUT TransportID parsing to the received buffer

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer corescsi3decodespeciport and corescsi3emulateregisterandmove hand the raw PERSISTENT RESERVE OUT parameter buffer to targetparseprouttransportid without tellin...

EUVD-2026-59101

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow...

CVE-2026-72232: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 "net: bridge: xmit: make sure we have at least eth header len bytes", it is possible by for a local user with eBPF TC hook access to attach a t...

PT-2026-72540

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the hid bpf get data function. The function returns a pointer to HID-BPF context data if the provided offset and size are within the ctx-allocated size...

Linux Distros Unpatched Vulnerability : CVE-2026-74474

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vxlan: use pskbnetworkmaypull for transmit path header pulls In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the...

Linux Distros Unpatched Vulnerability : CVE-2026-74473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vxlan: use pskbnetworkmaypull in routeshortcircuit routeshortcircuit currently calls pskbmaypullskb, sizeofstruct iphdr or ipv6hdr, which checks if bytes are...

PT-2026-72925

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the VXLAN implementation where the route shortcircuit function incorrectly uses pskb may pull to verify the availability of bytes for the IP header. Because skb-data...

PT-2026-72603

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ASOC SDCA component where the ge put enum double function fails to validate the user-supplied enumeration index item0 before passing it to snd soc enum item to val...

CVE-2026-72300: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

PT-2026-72420

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A local user with eBPF TC hook access can attach a tc filter that truncates a packet and redirects it to a batadv interface. The batadv interface tx function assumes that at least ETH HL...