EUVD-2026-59351

In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intelcrtcputcolorblobs drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intelcrtcprepareclearedstate, which fre...

CVE-2026-72452 drm/i915: clear CRTC color blob pointers after dropping refs

In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intelcrtcputcolorblobs drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intelcrtcprepareclearedstate, which fre...

CVE-2026-72449 drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadata without removing it from the list. The list head is left pointing a...

CVE-2026-72449 drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadata without removing it from the list. The list head is left pointing a...

CVE-2026-72449

CVE-2026-72449 : A Linux kernel flaw in drm/amdkfd causing list_del corruption during kfd_criu_resume_svm cleanup, leaving freed objects on the criu_svm_metadata_list. An unprivileged render-group user could trigger a use-after-free/double-free path via /dev/kfd. The fix adds list_del() before kf...

EUVD-2026-59348

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadata without removing it from the list. The list head is left pointing a...

CVE-2026-72427

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix effective prog array index with BPFFPREORDER replaceeffectiveprog and purgeeffectiveprogs located the slot in the effective array by walking the program hlist and counting entries linearly. That count does not match the...

CVE-2026-72421

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore error route in local/main tables. When CONFIGIPMULTIPLETABLES is enabled but no rule is added, fiblookup performs route lookup directly on two tables. Since the first lookup does not properly bail out, the...

CVE-2026-72414

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: round up PTP perout pin duration pinduration is converted from the user-provided period to SJA1105 clock ticks and is later passed as the cycletime argument to futurebasetime. Very small period values may becom...

CVE-2026-72406

CVE-2026-72406 relates to the Linux kernel sungem driver. The issue occurred during probe error handling: gem_init_one() could call gem_remove_one() on register_netdev() failure and then fall through to cleanup, potentially freeing the same resources twice (DMA block, MMIO, PCI regions, net_devic...

EUVD-2026-59305

In the Linux kernel, the following vulnerability has been resolved: net: sungem: fix probe error cleanup geminitone calls gemremoveone when registernetdev fails. gemremoveone unregisters and frees resources owned by the netdevice, including the DMA block, MMIO mapping, PCI regions, and the...

CVE-2026-72406 net: sungem: fix probe error cleanup

In the Linux kernel, the following vulnerability has been resolved: net: sungem: fix probe error cleanup geminitone calls gemremoveone when registernetdev fails. gemremoveone unregisters and frees resources owned by the netdevice, including the DMA block, MMIO mapping, PCI regions, and the...

CVE-2026-72406 net: sungem: fix probe error cleanup

In the Linux kernel, the following vulnerability has been resolved: net: sungem: fix probe error cleanup geminitone calls gemremoveone when registernetdev fails. gemremoveone unregisters and frees resources owned by the netdevice, including the DMA block, MMIO mapping, PCI regions, and the...

CVE-2026-72373

In the Linux kernel, the following vulnerability has been resolved: afs: Fix missing NULL pointer check in afsbreaksomecallbacks Fix afsbreaksomecallbacks to check to see if afslookupvolumercu returned NULL e.g. the specified volume is unknown...

CVE-2026-72371 afs: Fix the volume AFS_VOLUME_RM_TREE is set on

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFSVOLUMERMTREE is set on Fix afsinsertvolumeintocell to set AFSVOLUMERMTREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volume to be...

CVE-2026-72371

The CVE concerns the Linux kernel vulnerability in the AFS file system where AFS_VOLUME_RM_TREE is set on the wrong volume during afs_insert_volume_into_cell(). The fix changes the logic to set AFS_VOLUME_RM_TREE on the volume being replaced (not the new volume), because the new volume is removed...

EUVD-2026-59270

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFSVOLUMERMTREE is set on Fix afsinsertvolumeintocell to set AFSVOLUMERMTREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volume to be...

CVE-2026-72371 afs: Fix the volume AFS_VOLUME_RM_TREE is set on

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFSVOLUMERMTREE is set on Fix afsinsertvolumeintocell to set AFSVOLUMERMTREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volume to be...

CVE-2026-72368 cachefiles: Fix double unlock in nomem_d_alloc error path

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double unlock in nomemdalloc error path When startcreating fails and returns -ENOMEM, it has already released the parent directory lock in startdirop: static struct dentry startdirop... ... inodelocknesteddir,...

EUVD-2026-59267

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double unlock in nomemdalloc error path When startcreating fails and returns -ENOMEM, it has already released the parent directory lock in startdirop: static struct dentry startdirop... ... inodelocknesteddir,...