CVE-2026-72359 drm/xe: fix NPD in bo_meminfo()

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bomeminfo When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle...

EUVD-2026-59258

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bomeminfo When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle...

CVE-2026-72332 accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo()

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Prevent PM resume deadlock in hwctxsyncdebugbo amdxdnahwctxsyncdebugbo invokes the hardware hwctxsyncdebugbo callback while holding xdna-devlock. The callback may call amdxdnacmdsubmit, which in turn calls...

CVE-2026-72329 net/liquidio: drop cached VF pci_dev LUT

In the Linux kernel, the following vulnerability has been resolved: net/liquidio: drop cached VF pcidev LUT The PF SR-IOV enable path caches VF pcidev pointers in dpiringtovfpcidevlut by iterating with pcigetdevice. Those entries do not own a reference, because the iterator drops the previous...

EUVD-2026-59228

In the Linux kernel, the following vulnerability has been resolved: net/liquidio: drop cached VF pcidev LUT The PF SR-IOV enable path caches VF pcidev pointers in dpiringtovfpcidevlut by iterating with pcigetdevice. Those entries do not own a reference, because the iterator drops the previous...

EUVD-2026-59221

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary...

CVE-2026-72322 ipv6: mcast: Fix potential UAF in MLD delayed work

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary...

CVE-2026-72323 ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmpgqstarttimer A race condition exists between device teardown inetdevdestroy and incoming IGMP query processing igmprcv, leading to a Use-After-Free in the IGMP timer callback. During device...

CVE-2026-72323

CVE-2026-72323 — Linux kernel igmp UAF vulnerability : A race between device teardown (inetdev_destroy) and IGMP query processing (igmp_rcv) can cause a Use-After-Free in the IGMP timer callback when the timer is re-armed. The in_device memory is freed via RCU after its refcount reaches 0, but ig...

CVE-2026-72316 dm era: fix NULL pointer dereference in metadata_open()

In the Linux kernel, the following vulnerability has been resolved: dm era: fix NULL pointer dereference in metadataopen metadataopen returns NULL when kzallocobj fails, but the caller eractr only checks ISERRmd. Since ISERRNULL returns false, the NULL pointer is treated as a valid result and lat...

CVE-2026-72316

In the Linux kernel vulnerability CVE-2026-72316, the metadata_open() path used by device-mapper metadata handling returns NULL on kzalloc_obj() failure, but era_ctr() only checks IS_ERR(md). Since IS_ERR(NULL) is false, a NULL is treated as valid and later dereferenced (era->md). The fix is t...

EUVD-2026-59154

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: pin bridge device while NFQUEUE holds fake dst The brnetfilter fake rtable is embedded in struct netbridge and is attached to bridged packets with skbdstsetnoref. If such a packet is queued to NFQUEUE, nfqueue...

CVE-2026-72255 netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: pin bridge device while NFQUEUE holds fake dst The brnetfilter fake rtable is embedded in struct netbridge and is attached to bridged packets with skbdstsetnoref. If such a packet is queued to NFQUEUE, nfqueue...

CVE-2026-72255 netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: pin bridge device while NFQUEUE holds fake dst The brnetfilter fake rtable is embedded in struct netbridge and is attached to bridged packets with skbdstsetnoref. If such a packet is queued to NFQUEUE, nfqueue...

CVE-2026-72245

CVE-2026-72245 relates to the Linux kernel GPU host1x driver, where a reference leak could occur in host1x_device_parse_dt() after device_initialize(). The embedded struct device was freed directly via kfree(device) in the error path, bypassing normal device lifetime handling and leaking a refere...

EUVD-2026-59144

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix device reference leak in host1xdeviceparsedt error path After deviceinitialize, the embedded struct device in struct host1xdevice should be released through the device core with putdevice. In host1xdeviceadd, if...

CVE-2026-72245 gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix device reference leak in host1xdeviceparsedt error path After deviceinitialize, the embedded struct device in struct host1xdevice should be released through the device core with putdevice. In host1xdeviceadd, if...

CVE-2026-72245 gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix device reference leak in host1xdeviceparsedt error path After deviceinitialize, the embedded struct device in struct host1xdevice should be released through the device core with putdevice. In host1xdeviceadd, if...

CVE-2026-72240 mfd: sm501: Fix reference leak on failed device registration

In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix reference leak on failed device registration When platformdeviceregister fails in sm501registerdevice, the embedded struct device in pdev has already been initialized by deviceinitialize, but the failure path only...

CVE-2026-72240

The CVE-2026-72240 entry describes a Linux kernel issue in the mfd: sm501 driver where a reference leak occurs when platform_device_register() fails during sm501_register_device(). The embedded struct device in pdev is initialized (via device_initialize()), then proceeds through setup_pdev_dma_ma...