CVE-2026-72090

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

CVE-2026-72076

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in imspcuirq debug logging The debug logging in imspcuirq unconditionally prints data from pcu-urbinbuf. However, if the interrupt fired for pcu-urbctrl, the actual data resides in...

CVE-2026-72076

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in imspcuirq debug logging The debug logging in imspcuirq unconditionally prints data from pcu-urbinbuf. However, if the interrupt fired for pcu-urbctrl, the actual data resides in...

UBUNTU-CVE-2026-72037

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Initialize ethsyslock spinlock before use lan743xhardwareinit calls pci11x1xstrapgetstatus during the PCI11x1x probe sequence. That helper acquires the Ethernet subsystem hardware lock via lan743xhssyslockacquire,...

UBUNTU-CVE-2026-72090

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

UBUNTU-CVE-2026-72076

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in imspcuirq debug logging The debug logging in imspcuirq unconditionally prints data from pcu-urbinbuf. However, if the interrupt fired for pcu-urbctrl, the actual data resides in...

CVE-2026-72090

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

CVE-2026-72037

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Initialize ethsyslock spinlock before use lan743xhardwareinit calls pci11x1xstrapgetstatus during the PCI11x1x probe sequence. That helper acquires the Ethernet subsystem hardware lock via lan743xhssyslockacquire,...

UBUNTU-CVE-2026-72005

In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00libprobedev uses the full rt2x00libremovedev teardown for all probe failures. However, drvdata allocation and workqueue allocation can fail before intfwork,...

EUVD-2026-59274

In the Linux kernel, the following vulnerability has been resolved: afs: Fix reinitialisation of the inode, in particular -lockwork It seems that initalising afsvnode::lockwork a single time in the slab's init function isn't sufficient for workstructs. This results in the DEBUGOBJECTS debugging...

CVE-2026-72332 accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo()

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Prevent PM resume deadlock in hwctxsyncdebugbo amdxdnahwctxsyncdebugbo invokes the hardware hwctxsyncdebugbo callback while holding xdna-devlock. The callback may call amdxdnacmdsubmit, which in turn calls...

CVE-2026-72152

CVE-2026-72152 concerns the Linux kernel component related to TPM SPI handling (tpm_tis_spi) and the wait-for-status flow used in wait_for_tmp_stat(). The issue arises from how wait_event_interruptible_timeout() evaluates its condition after setting the task state to TASK_INTERRUPTIBLE, which can...

EUVD-2026-58910

In the Linux kernel, the following vulnerability has been resolved: tpm: tpmtisspi: Use waitwoken in waitfortmpstat waiteventinterruptibletimeout evaluates its condition after setting the current task state to TASKINTERRUPTIBLE. With CONFIGDEBUGATOMICSLEEP this triggers a warning when the IRQ wai...

CVE-2026-72152 tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()

In the Linux kernel, the following vulnerability has been resolved: tpm: tpmtisspi: Use waitwoken in waitfortmpstat waiteventinterruptibletimeout evaluates its condition after setting the current task state to TASKINTERRUPTIBLE. With CONFIGDEBUGATOMICSLEEP this triggers a warning when the IRQ wai...

CVE-2026-72090 accel/amdxdna: Use caller client for debug BO sync

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

CVE-2026-72090 accel/amdxdna: Use caller client for debug BO sync

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

CVE-2026-72090

CVE-2026-72090 affects the Linux kernel component accel/amdxdna. The root cause is in the ioctl flow for SYNC_DIRECT_FROM_DEVICE: amdxdna_drm_sync_bo_ioctl() looked up args->handle in the caller’s drm_file and then invoked amdxdna_hwctx_sync_debug_bo() with abo->client. The function uses th...

EUVD-2026-59048

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

CVE-2026-72076 Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in imspcuirq debug logging The debug logging in imspcuirq unconditionally prints data from pcu-urbinbuf. However, if the interrupt fired for pcu-urbctrl, the actual data resides in...

EUVD-2026-59034

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in imspcuirq debug logging The debug logging in imspcuirq unconditionally prints data from pcu-urbinbuf. However, if the interrupt fired for pcu-urbctrl, the actual data resides in...