CVE-2026-72256 netfilter: xt_cluster: reject template conntracks in hash match

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This causes a state confusion bug when the raw table C...

CVE-2026-72253 netfilter: nf_conntrack_sip: validate skb_dst() before accessing it

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: validate skbdst before accessing it tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relies o...

CVE-2026-72253

Summary (CVE-2026-72253) : In the Linux kernel, the netfilter nf_conntrack_sip path is fixed to validate skb_dst() before use. The SIP helper relies on skb_dst() being present when sip_external_media is enabled, but tc ingress and Open vSwitch may not guarantee routing information, so the toggle ...

CVE-2026-72253 netfilter: nf_conntrack_sip: validate skb_dst() before accessing it

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: validate skbdst before accessing it tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relies o...

CVE-2026-72253

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: validate skbdst before accessing it tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relies o...

CVE-2026-72252

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nftpipapomatch can enter a bad state: - some fields can have their lookup tables resized while others did not - bits...

CVE-2026-72251

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnatsip: reload possible stale data pointer quoting sashiko: ------------------------------------------------------------------------ .. noticed a potential memory bug and header corruption involving the SIP NAT helpe...

CVE-2026-72250 netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag nfctfrag6reasm slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb-macheader: skb-macheader += sizeofstru...

CVE-2026-72247

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: fix zone comparison in tuple dedup The "already exists" dedup logic in nfconncountadd decides whether a connection has already been counted and can be skipped instead of incrementing the connlimit count. I...

CVE-2026-72246

Removed by vendor...

CVE-2026-72244 gpu/buddy: bail out of try_harder when alignment cannot be honoured

In the Linux kernel, the following vulnerability has been resolved: gpu/buddy: bail out of tryharder when alignment cannot be honoured The tryharder contiguous fallback could return a range whose start offset did not match the caller's minblocksize. When a candidate's start is misaligned, realign...

EUVD-2026-59143

In the Linux kernel, the following vulnerability has been resolved: gpu/buddy: bail out of tryharder when alignment cannot be honoured The tryharder contiguous fallback could return a range whose start offset did not match the caller's minblocksize. When a candidate's start is misaligned, realign...

CVE-2026-72242

In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sksocket dereference in selinuxsctpbindconnect selinuxsctpbindconnect dereferences sk-sksocket to pass a struct socket to selinuxsocketbind and selinuxsocketconnecthelper. However, when the hook is invoked from the...

CVE-2026-72237

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/brs: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERFSAMPLEBRANCHUSER is requested. On AM...

CVE-2026-72233

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: reacquire gw address after skb realloc The pskbmaypull called by batadvblaisbackbonegw could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-72231 batman-adv: tt: avoid request storms during pending request

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: avoid request storms during pending request batadvsendttrequest allocates a ttreqnode when none exists for the destination originator node. This should prevent that a multiple TT requests are send at the same time...

CVE-2026-72229

In the Linux kernel, the following vulnerability has been resolved: batman-adv: clean untagged VLAN on netdev registration failure When an mesh interface is registered, it creates an untagged struct batadvmeshifvlan on top of it via the NETDEVREGISTER notifier. But in this process, another receiv...

EUVD-2026-59127

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: fix primaryif leak on failed linearization If the skb has a fraglist, it must be linearized before it can be split using skbsplit. But when this step failed, it must not only free the skb but also take care of t...

CVE-2026-72226

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadvtvlvttvlandata 8 bytes. The size can therefore...

CVE-2026-72225

The CVE-2026-72225 issue is in the Linux kernel’s journal code (jbd2). A numeric underflow occurs in jbd2_journal_initialize_fast_commit() when calculating journal capacity with (journal->j_last - num_fc_blks) where both operands are unsigned; if num_fc_blks > j_last, the subtraction wraps ...