CVE-2026-72341 net/mlx5e: Fix publication race for priv->channel_stats[]

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix publication race for priv-channelstats mlx5echannelstatsalloc publishes a new entry to priv-channelstats and then increments priv-statsnch as a publication token, but neither store carries any memory barrier:...

CVE-2026-72341 net/mlx5e: Fix publication race for priv->channel_stats[]

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix publication race for priv-channelstats mlx5echannelstatsalloc publishes a new entry to priv-channelstats and then increments priv-statsnch as a publication token, but neither store carries any memory barrier:...

EUVD-2026-59240

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix publication race for priv-channelstats mlx5echannelstatsalloc publishes a new entry to priv-channelstats and then increments priv-statsnch as a publication token, but neither store carries any memory barrier:...

CVE-2026-72341

CVE-2026-72341 affects the Linux kernel net/mlx5e: a publication race in priv->channel_stats[] where mlx5e_channel_stats_alloc() writes channel_stats[ix] before updating stats_nch, without memory barriers. On weakly-ordered architectures (ARM, PowerPC, RISC-V) readers may observe stats_nch == ...

EUVD-2026-59233

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last. If controller sends malformed sequence ISOSTA...

CVE-2026-72334 Bluetooth: ISO: fix malformed ISO_END/CONT handling

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last. If controller sends malformed sequence ISOSTA...

CVE-2026-72327 drm/v3d: Reject invalid indirect BO handle in indirect CSD setup

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3dgetcpuindirectcsdparams looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes...

CVE-2026-72327 drm/v3d: Reject invalid indirect BO handle in indirect CSD setup

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3dgetcpuindirectcsdparams looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes...

CVE-2026-72327

The CVE-2026-72327 issue affects the Linux kernel DRM v3d indirect CSD setup. v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object from a userspace-supplied handle and may return NULL; this NULL is stored in info->indirect and later dereferenced by the indirect CSD job, turnin...

CVE-2026-72316 dm era: fix NULL pointer dereference in metadata_open()

In the Linux kernel, the following vulnerability has been resolved: dm era: fix NULL pointer dereference in metadataopen metadataopen returns NULL when kzallocobj fails, but the caller eractr only checks ISERRmd. Since ISERRNULL returns false, the NULL pointer is treated as a valid result and lat...

EUVD-2026-59215

In the Linux kernel, the following vulnerability has been resolved: dm era: fix NULL pointer dereference in metadataopen metadataopen returns NULL when kzallocobj fails, but the caller eractr only checks ISERRmd. Since ISERRNULL returns false, the NULL pointer is treated as a valid result and lat...

CVE-2026-72316

In the Linux kernel vulnerability CVE-2026-72316, the metadata_open() path used by device-mapper metadata handling returns NULL on kzalloc_obj() failure, but era_ctr() only checks IS_ERR(md). Since IS_ERR(NULL) is false, a NULL is treated as valid and later dereferenced (era->md). The fix is t...

CVE-2026-72257 ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm: fix NULL pointer dereference in graphcallback When q6apmfreefragments is called it frees rxdata.buf/txdata.buf and sets them to NULL under graph-lock. A late DSP buffer-done response can race with this:...

CVE-2026-72257 ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm: fix NULL pointer dereference in graphcallback When q6apmfreefragments is called it frees rxdata.buf/txdata.buf and sets them to NULL under graph-lock. A late DSP buffer-done response can race with this:...

EUVD-2026-59156

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm: fix NULL pointer dereference in graphcallback When q6apmfreefragments is called it frees rxdata.buf/txdata.buf and sets them to NULL under graph-lock. A late DSP buffer-done response can race with this:...

CVE-2026-72257

CVE-2026-72257 affects the Linux kernel ASoC qcom stack (q6apm). The root cause is a potential NULL pointer dereference in graph_callback when a late DSP buffer-done response races with q6apm_free_fragments() which frees and NULLs rx/tx buffers under graph->lock. The code path can dereference ...

EUVD-2026-59153

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftfib: reject fib expression on the netdev egress hook A fib expression in a netdev egress base chain dereferences nftinpkt, NULL on the transmit path, causing a NULL pointer dereference at eval. nftfibvalidate masks...

CVE-2026-72254

The CVE-2026-72254 entry concerns the Linux kernel netfilter NFT_FIB logic. A fib expression in a netdev egress base chain could dereference nft_in(pkt) on the transmit path, yielding a NULL pointer dereference during eval. The root cause is that nft_fib_validate() masks the hook with NF_INET_* v...

CVE-2026-72254 netfilter: nft_fib: reject fib expression on the netdev egress hook

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftfib: reject fib expression on the netdev egress hook A fib expression in a netdev egress base chain dereferences nftinpkt, NULL on the transmit path, causing a NULL pointer dereference at eval. nftfibvalidate masks...

CVE-2026-72254 netfilter: nft_fib: reject fib expression on the netdev egress hook

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftfib: reject fib expression on the netdev egress hook A fib expression in a netdev egress base chain dereferences nftinpkt, NULL on the transmit path, causing a NULL pointer dereference at eval. nftfibvalidate masks...