CVE-2026-72067 cpu: hotplug: Preserve per instance callback errors

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhpinvokecallback unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the...

CVE-2026-72067

CVE-2026-72067 affects the Linux kernel CPU hotplug path. The issue arises in cpuhp_invoke_callback() where, if one instance fails, the rollback path reuses the prior return value, which can hide the original error and make a failed transition appear successful. The fix is to keep the rollback re...

CVE-2026-72067 cpu: hotplug: Preserve per instance callback errors

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhpinvokecallback unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the...

CVE-2026-68466 mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: lpc32xxslc: fail DMA transfer on completion timeout lpc32xxxmitdma waits for the DMA completion callback but ignores waitforcompletiontimeout. A timed out DMA transfer is therefore unmapped and reported as successfu...

CVE-2026-72374: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incomi...

PT-2026-72698

In the Linux kernel, the following vulnerability has been resolved: kcm: use WRITE ONCE when changing lower socket callbacks kcm attach replaces a live lower TCP socket's sk data ready and sk write space callbacks with KCM handlers, and kcm unattach restores them later. Those callback-pointer...

PT-2026-72511

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmp gq start timer A race condition exists between device teardown inetdev destroy and incoming IGMP query processing igmp rcv, leading to a Use-After-Free in the IGMP timer callback. During devi...

PT-2026-72861

In the Linux kernel, the following vulnerability has been resolved: afs: handle CB.InitCallBackState3 requests without a server record The cache manager callback path now attaches the server record to an incoming call through the rxrpc peer's app data. That association is not guaranteed to exist...

PT-2026-72562

In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incomi...

CVE-2026-72126: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronizercu in isotprelease isotpnotify unregisters the RCU CAN filters via canrxunregister and clears so-bound without waiting for a grace period. isotprelease uses so-bound to decide whether it...

PT-2026-72264

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ims pcu reset device sysfs callback. The issue occurs because the callback invokes the ims pcu execute command function without acquiring the pcu-cmd mutex...

PT-2026-72561

In the Linux kernel, the following vulnerability has been resolved: afs: Fix missing NULL pointer check in afs break some callbacks Fix afs break some callbacks to check to see if afs lookup volume rcu returned NULL e.g. the specified volume is unknown...

PT-2026-72256

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhp invoke callback unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the...

PT-2026-72315

In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronize rcu in isotp release isotp notify unregisters the RCU CAN filters via can rx unregister and clears so-bound without waiting for a grace period. isotp release uses so-bound to decide wheth...

SUSE CVE-2026-68141

In the Linux kernel, the following vulnerability has been resolved: net/afiucv: fix NULL deref in afiucvhscallbacksyn afiucvhscallbacksyn allocates the child socket with GFPATOMIC. If the allocation fails, nsk is NULL. The connection-refused path is entered when the listen state check fails, the...

GHSA-29RF-F4VV-PVQ6 Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts

The OAuth callback handler links incoming OAuth identities Google, GitHub, etc. to existing accounts matched by email address without verifying that the existing account's email was verified by its original owner. An attacker who pre-registers with a victim's email address without verifying it...

WordPress Paymob for WooCommerce plugin < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup vulnerability

Unauthenticated SQL Injection via Paymob Callback Pixel Lookup vulnerability discovered by Artus KG in WordPress Plugin Paymob for WooCommerce versions 4.1.9...

WordPress Welcart e-Commerce plugin < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback vulnerability

Unauthenticated Payment Bypass via Forged Settlement Callback vulnerability discovered by Pedro Pinho in WordPress Plugin Welcart e-Commerce versions 2.11.33...

CVE-2026-15205

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-15205 Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...