CVE-2026-72118

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN detected a data race within the bcmrxhandler when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. Use atomic operations with...

CVE-2026-72119

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcmtxlock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there, mirroring the approach already used in bcmrxsetup. Only copy the validat...

CVE-2026-72117

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix data race on rxstamp/rxifindex in bcmrxhandler For an rx op subscribed on all interfaces ifindex == 0, the same op is registered once in the shared per-netns wildcard filter list, so bcmrxhandler can run concurrentl...

CVE-2026-72101

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix leaking uninitialized kernel memory If hash size is less than device's tuple size, dm-integrity is supposed to zero the remaining space. There was a bug in the code that zeroing didn't work. This commit fixes it...

CVE-2026-72075

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix race condition in resetdevice sysfs callback The imspcuresetdevice sysfs callback calls imspcuexecutecommand without acquiring pcu-cmdmutex. This can lead to data races and corruption of the shared command...

CVE-2026-72043

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix missing dirty page tracking in pte,pmdwrprotect When hardware page table walker PTW is enabled on LoongArch, the CPU may set PAGEDIRTY directly in the page table entry during a write TLB miss, without going through...

CVE-2026-72027

In the Linux kernel, the following vulnerability has been resolved: mm/compaction: handle freepagesprepare properly in compactionfree freepagesprepare can fail but compactionfree does not handle the failure case. Failed pages should not be added back to cc-freepages for future use, since they can...

CVE-2026-72164

In the Linux kernel, the following vulnerability has been resolved: ocfs2: avoid moving extents to occupied clusters For non-auto OCFS2IOCMOVEEXT operations, userspace supplies a physical megoal. ocfs2moveextent initializes newphyscpos from that goal and expects ocfs2probeallocgroup to replace it...

UBUNTU-CVE-2026-72099

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: don't increment hashoffset twice hashoffset is already incremented in the loop "for i = 0; i tocopy; i++, ts--". Do not increment it again...

UBUNTU-CVE-2026-72164

In the Linux kernel, the following vulnerability has been resolved: ocfs2: avoid moving extents to occupied clusters For non-auto OCFS2IOCMOVEEXT operations, userspace supplies a physical megoal. ocfs2moveextent initializes newphyscpos from that goal and expects ocfs2probeallocgroup to replace it...

UBUNTU-CVE-2026-72117

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix data race on rxstamp/rxifindex in bcmrxhandler For an rx op subscribed on all interfaces ifindex == 0, the same op is registered once in the shared per-netns wildcard filter list, so bcmrxhandler can run concurrentl...

UBUNTU-CVE-2026-72168

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix fault in unaligned fixup Use kzallocobj / kzallocobjs to allocate the memcard structs, instead of kmallocobj / kmallocobjs to prevent access to uninitialized data. Fixes runtime error: Fault in unaligned...

UBUNTU-CVE-2026-72119

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcmtxlock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there, mirroring the approach already used in bcmrxsetup. Only copy the validat...

CVE-2026-72118

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN detected a data race within the bcmrxhandler when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. Use atomic operations with...

CVE-2026-72134

In the Linux kernel, the following vulnerability has been resolved: spi: imx: reconfigure for PIO when DMA cannot be started When spiimxcandma selects DMA, the ECSPI is configured for DMA: spiimxsetupxfer sets CTRL.SMC and clears dynamicburst, and spiimxdmatransfer programs the dynamic-burst...

CVE-2026-72121

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcmrxsetup when updating timer and filter content while bcmrxhandler, bcmrxtimeouthandler...

CVE-2026-72207

In the Linux kernel, the following vulnerability has been resolved: ntfs: not change 0-byte $DATA attribute to non-resident When ntfsresidentattrresize cannot grow a resident attribute in place, it retries after converting other resident attributes to non-resident to free space in the MFT recrord...

UBUNTU-CVE-2026-72147

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma-pcie: Reject devices without driver data dwedmapcieprobe treats the PCI device ID driverdata as the template for the controller layout and copies it unconditionally. A device bound dynamically via sysfs can mat...

CVE-2026-72129

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmetrdmauseinlinesg maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len offset = off;...

UBUNTU-CVE-2026-72129

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmetrdmauseinlinesg maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len offset = off;...