CVE-2026-72038

The CVE-2026-72038 entry documents a Linux kernel issue in the net: liquidio driver where BAR resources are leaked on PF number failure. Root cause: cn23xx_get_pf_num() may fail and return without unmapping either BAR, leading to a resource leak. The fix unmaps both BARs before returning from the...

CVE-2026-72038 net: liquidio: fix BAR resource leak on PF number failure

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: fix BAR resource leak on PF number failure If cn23xxgetpfnum fails, the function returns without unmapping either BAR. Unmap both BARs before returning from the error path. Found by manual code review...

CVE-2026-72038 net: liquidio: fix BAR resource leak on PF number failure

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: fix BAR resource leak on PF number failure If cn23xxgetpfnum fails, the function returns without unmapping either BAR. Unmap both BARs before returning from the error path. Found by manual code review...

CVE-2026-72027

CVE-2026-72027 affects the Linux kernel in the memory management compaction path. The vulnerability stems from improper handling of the return value of free_pages_prepare() within compaction_free(); when free_pages_prepare() fails, compaction_free() may still add pages back into cc->freepages,...

CVE-2026-72026

The CVE-2026-72026 vulnerability is in the Linux kernel IRQ subsystem for riscv IMSIC early initialization. The issue: imsic_early_acpi_init() allocates a firmware node before IMSIC state setup; if imsic_setup_state() fails, the allocated fwnode is not freed. The fix adds cleanup on the error pat...

CVE-2026-72026 irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure

In the Linux kernel, the following vulnerability has been resolved: irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure imsicearlyacpiinit allocates a firmware node before setting up the IMSIC state. If imsicsetupstate fails, the function returns without freeing the allocated...

CVE-2026-72023

CVE-2026-72023 affects the Linux kernel’s octeontx2-pf driver. otx2_init_hw_resources() allocates SQ aura/pool resources before later setup steps, and on failure err_free_sq_ptrs frees only SQB pages, leaving per-SQ sqb_ptrs behind. The documented fix uses otx2_free_sq_res() for the SQ unwind pat...

CVE-2026-68475 reset: sunxi: fix memory region leak on ioremap failure

In the Linux kernel, the following vulnerability has been resolved: reset: sunxi: fix memory region leak on ioremap failure In sunxiresetinit, when ioremap fails, the memory region obtained via requestmemregion is not released, leading to a resource leak. Add an errmemregion label to properly...

EUVD-2026-59087

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: fix esdhcchangepinstate to allow default state restore esdhcchangepinstate checks for pins100mhz and pins200mhz at the top of the function and returns -EINVAL if either is not defined. This prevents the...

EUVD-2026-59085

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: use pmruntimeresumeandget in suspend Replace pmruntimegetsync with pmruntimeresumeandget to simplify error handling. pmruntimeresumeandget automatically drops the usage counter on failure, avoiding the need...

CVE-2026-68463

CVE-2026-68463 affects the Linux kernel component mmc: sdhci-esdhc-imx . The vulnerability arises from suspend handling where code was changed to use pm_runtime_resume_and_get() instead of pm_runtime_get_sync() to simplify error handling. The new function automatically drops the usage counter on ...

CVE-2026-68463 mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: use pmruntimeresumeandget in suspend Replace pmruntimegetsync with pmruntimeresumeandget to simplify error handling. pmruntimeresumeandget automatically drops the usage counter on failure, avoiding the need...

Cross-Site Scripting (XSS)

Spring Web Flow is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the JavaScript RemotingHandler rendering error-response bodies as HTML even when the response is not text/html, which allows an attacker to exploit the issue by injecting malicious input that is reflected in...

SUSE CVE-2026-6464

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line...

CVE-2026-72496: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Proper rollback if the ioremap fails bnxtqpliballocdpi returns success even if ioremap fails. Add the proper rollback when the ioremap fails and return -ENOMEM status...

CVE-2026-72168: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix fault in unaligned fixup Use kzallocobj / kzallocobjs to allocate the memcard structs, instead of kmallocobj / kmallocobjs to prevent access to uninitialized data. Fixes runtime error: Fault in unaligned...

PT-2026-72458

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the fbdev s3fb component. In the s3 pci probe function, memory allocated for modelist via the fb videomode to modelist function is not properly released during...

CVE-2026-72423: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an optssz argument. The verifier checks only the memory range described by optssz, but the wrappers...

PT-2026-72947

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the igbvf driver during TX DMA error cleanup. When an error occurs while mapping TX buffers, the driver fails to correctly unmap all buffers already mapped for th...

CVE-2026-74375: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix deadlock in read error recovery path raid1d and raid10d may resubmit a split md cloned bio while handling a read error. In this case, resubmitting the bio can lead to a deadlock if the array is suspended befo...