CVE-2026-74353

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: always resumeall after suspendall Need to restore any good queues even if the suspendall failed for some. Always run removequeue as that will schedule a GPU reset is removing the queue fails. v2: move resumeall after...

UBUNTU-CVE-2026-74379

In the Linux kernel, the following vulnerability has been resolved: dax/kmem: account for partial discontiguous resource upon removal When devdaxkmemprobe partially succeeds at least one range is mapped but a subsequent range fails requestmemregion or addmemorydrivermanaged, the probe silently...

UBUNTU-CVE-2026-72439

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writespending leak on write request failures raid10makerequest acquires a writespending reference with mdwritestart before dispatching write requests. Several failure paths in raid10writerequest complete the bio an...

UBUNTU-CVE-2026-74398

In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: bail out of dadfailure when state is no longer POSTDAD addrconfdadfailure transitions ifp-state from DAD to POSTDAD via addrconfdadend, which drops ifp-lock on return. The lock is re-acquired after...

CVE-2026-74263

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: check skbclone in control TX t7xxportctrltx clones each skb fragment before passing it to the port transmit path. The clone is used immediately to set cloned-len, so an skbclone failure results in a NULL pointer...

UBUNTU-CVE-2026-72438

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writespending and barrier reference leaks on discard failures raid10makerequest acquires a writespending reference with mdwritestart before calling raid10handlediscard. Several failure paths in raid10handlediscard...

UBUNTU-CVE-2026-72440

In the Linux kernel, the following vulnerability has been resolved: md/raid1: fix writespending and barrier reference leaks on write failures raid1makerequest acquires a writespending reference with mdwritestart before calling raid1writerequest. Several failure paths in raid1writerequest complete...

UBUNTU-CVE-2026-72467

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwrwpcreate during connect frwrwpcreate creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave...

CVE-2026-72439

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writespending leak on write request failures raid10makerequest acquires a writespending reference with mdwritestart before dispatching write requests. Several failure paths in raid10writerequest complete the bio an...

CVE-2026-72252

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nftpipapomatch can enter a bad state: - some fields can have their lookup tables resized while others did not - bits...

CVE-2026-72205

In the Linux kernel, the following vulnerability has been resolved: ntfs: free volume-wide resources on fillsuper failure ntfsfillsuper's erroutnow path frees only the volume struct via kfreevol, leaving several vol-owned allocations behind on every mount failure: - vol-nlsmap, loaded by...

CVE-2026-72185

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix WARNON for resident attribute in ntfsmaprunlistnolock When ntfsmaprunlistnolock needs to look up the attribute extent containing a target VCN ctxneedsreset == true, it calls ntfsattrlookup and then expects the result to...

CVE-2026-72122

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix lockless bound/ifindex race and silent RXSETUP failure bcmsendmsg reads bo-ifindex and checks bo-bound before taking locksock, while bcmnotify, bcmconnect and bcmrelease all mutate both fields under that same lock...

CVE-2026-72109

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: unregister blocking notifier on init failure sparx5registernotifierblocks registers the switchdev blocking notifier before allocating the ordered workqueue. If the workqueue allocation fails, the error path unregiste...

CVE-2026-72108

In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consistency on commit failure reservemetadatasnap and releasemetadatasnap modify the superblock's heldroot directly in the blockmanager's buffer. If the subsequent metadata commit fails, th...

CVE-2026-72073

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: fix use-after-free on probe failure The vub300 driver lifetime-manages its controller state using vub300-kref, with vub300delete freeing the mmc host when the last reference is dropped. The probe error path after the...

CVE-2026-72050

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Free BPID bitmap on setup failure nixsetupbpids allocates bp-bpids with rvuallocbitmap, which uses a plain kcalloc. If any of the following devmkcalloc allocations for the BPID mapping arrays fails, the function...

UBUNTU-CVE-2026-72038

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: fix BAR resource leak on PF number failure If cn23xxgetpfnum fails, the function returns without unmapping either BAR. Unmap both BARs before returning from the error path. Found by manual code review...

CVE-2026-72122

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix lockless bound/ifindex race and silent RXSETUP failure bcmsendmsg reads bo-ifindex and checks bo-bound before taking locksock, while bcmnotify, bcmconnect and bcmrelease all mutate both fields under that same lock...

CVE-2026-72252

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nftpipapomatch can enter a bad state: - some fields can have their lookup tables resized while others did not - bits...