EUVD-2026-58877

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcmtxlock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there, mirroring the approach already used in bcmrxsetup. Only copy the validat...

CVE-2026-72119

Summary: CVE-2026-72119 concerns a Linux kernel CAN subsystem issue in bcm_tx_lock usage during data and timer updates. The fix stages new CAN frame content for an existing tx operation into a kmalloc() buffer, validates it there, and only copies validated data into op->frames while holding op...

CVE-2026-72119 can: bcm: extend bcm_tx_lock usage for data and timer updates

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcmtxlock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there, mirroring the approach already used in bcmrxsetup. Only copy the validat...

EUVD-2026-59072

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP, but bcmrxsetup never did the same for the RTR-reply frame configure...

CVE-2026-72114

In the Linux kernel CAN BCM subsystem, CVE-2026-72114 is due to bcm_rx_setup() not validating the frame length for RTR-reply frames configured via RX_SETUP with RX_RTR_FRAME, unlike bcm_tx_setup() which validates cf->len against CAN/CAN FD DLC limits. The vulnerability is resolved by adding va...

CVE-2026-72114 can: bcm: validate frame length in bcm_rx_setup() for RTR replies

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP, but bcmrxsetup never did the same for the RTR-reply frame configure...

CVE-2026-72106 dm-ioctl: fix a possible overflow in list_version_get_info

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

CVE-2026-72106 dm-ioctl: fix a possible overflow in list_version_get_info

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

EUVD-2026-59064

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

CVE-2026-72106

In the Linux kernel, the dm-ioctl path in list_version_get_info has a potential buffer overflow: sizeof(tt->version) is 12 bytes, but the code writes 16 bytes into the output buffer (info->vers->version[0..2] and info->vers->next). The fix replaces sizeof(tt->version) with sizeo...

CVE-2026-72105 dm-log: fix a bitset_size overflow on 32bit machines

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitsetsize overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to regioncount overflow" made sure that regioncount could fit in an unsigned int. But the bitmap memory isn't allocated...

CVE-2026-72101 dm-integrity: fix leaking uninitialized kernel memory

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix leaking uninitialized kernel memory If hash size is less than device's tuple size, dm-integrity is supposed to zero the remaining space. There was a bug in the code that zeroing didn't work. This commit fixes it...

CVE-2026-72099 dm-integrity: don't increment hash_offset twice

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: don't increment hashoffset twice hashoffset is already incremented in the loop "for i = 0; i tocopy; i++, ts--". Do not increment it again...

CVE-2026-72099 dm-integrity: don't increment hash_offset twice

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: don't increment hashoffset twice hashoffset is already incremented in the loop "for i = 0; i tocopy; i++, ts--". Do not increment it again...

CVE-2026-72098 dm-verity: fix buffer overflow in FEC calculation

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if neras && neras fec-roots fio-erasuresneras++ = i; This allows neras to reach roots + 1 the post-increment pushes it past roots. This...

CVE-2026-72098

The CVE-2026-72098 issue affects the Linux kernel’s dm-verity FEC calculation. A buffer overflow occurs in dm-verity-fec when computing erasures: if (neras && *neras fec->roots) fio->erasures[(*neras)++] = i;. The post-increment can push *neras to roots+1, which is passed as no_eras to deco...

CVE-2026-72098 dm-verity: fix buffer overflow in FEC calculation

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if neras && neras fec-roots fio-erasuresneras++ = i; This allows neras to reach roots + 1 the post-increment pushes it past roots. This...

EUVD-2026-59056

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if neras && neras fec-roots fio-erasuresneras++ = i; This allows neras to reach roots + 1 the post-increment pushes it past roots. This...

CVE-2026-72097

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix a possible NULL pointer dereference Fix a possible NULL pointer dereference dmverityloadpinisbdevtrusted if the device has no table...

CVE-2026-72095

The CVE-2026-72095 issue affects the Linux kernel dma_fence_dedup_array() function, which incorrectly returned 1 for a 0-length input, contradicting the documented contract. The bug could allow a zero local count path to reach a dedup call and dereference an uninitialized fence slot (notably in a...