CVE-2026-72369 minix: avoid overflow in bitmap block count calculation

In the Linux kernel, the following vulnerability has been resolved: minix: avoid overflow in bitmap block count calculation minixchecksuperblock uses minixblocksneeded to verify that the on-disk imap and zmap block counts are large enough for the advertised inode and zone counts. The helper...

CVE-2026-72369

CVE-2026-72369 (Minix) - detail summary : The Linux kernel vulnerability arises in minix_check_superblock() where minix_blocks_needed() uses unsigned DIV_ROUND_UP(), allowing s_ninodes/s_zones near UINT_MAX to wrap to zero, making a zero bitmap-block count appear valid. This can lead to dereferen...

CVE-2026-72211

The CVE concerns the Linux kernel NTFS handling in ntfs_ir_reparent(), where a root stub may grow beyond the resident index root value. The code can publish a larger index header (index_length/allocated_size) before resizing the resident value, so if a resize fails with ENOSPC, recovery paths may...

EUVD-2026-58966

In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfsealookup and ntfslistxattr, this verifies that there is enough space in the EA entry before accessing the nextentryoffset field of the EA entry...

CVE-2026-72206

The CVE-2026-72206 entry concerns the Linux kernel NTFS index block validation. A stricter validation was added for INDEX_HEADER geometry in INDX blocks via ntfs_index_block_inconsisent(), and ntfs_lookup_inode_by_name() was updated to use this validation. This fixes a vulnerability in how INDX b...

CVE-2026-72206 ntfs: validate index block header more strictly

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index block header more strictly Modify ntfsindexblockinconsisent to perform stricter validation of INDEXHEADER geometry in INDX blocks, and update ntfslookupinodebyname to use that function to validate INDX blocks...

CVE-2026-72205

The CVE-2026-72205 entry concerns a Linux kernel ntfs mount failure leak: on fill_super error paths, vol-owned allocations (nls_map, volume_label) and lcn_empty_bits_per_page were not freed, leading to per‑mount leaks until module unload. The issue affects ntfs_fill_super() and err_out_now paths,...

CVE-2026-72203

CVE-2026-72203 concerns the Linux kernel NTFS driver and describes a deadlock (ABBA) between extent_lock and extent mrec_lock triggered by writes to normal extents and the $MFT folio. The fix removes all extent_lock and extent mrec_lock acquisitions from the MFT folio writeback path, eliminating ...

EUVD-2026-58960

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid heap allocation for free-cluster readahead state getnrfreeclusters allocates a temporary filerastate before it publishes the precomputed free cluster count, sets NVolFreeClusterKnown, and wakes vol-freewaitq. If that...

CVE-2026-72201 ntfs: validate index entries on reading

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index entries on reading Validate index entries immediately after reading an index root or index block from disk. This eliminates repeated checks in lookup and readdir, and reduce the risk of missing checks in thos...

EUVD-2026-58959

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index entries on reading Validate index entries immediately after reading an index root or index block from disk. This eliminates repeated checks in lookup and readdir, and reduce the risk of missing checks in thos...

EUVD-2026-58952

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indxfindbuffer to prevent stack overflow indxfindbuffer recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded recursion,...

CVE-2026-72194 fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indxfindbuffer to prevent stack overflow indxfindbuffer recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded recursion,...

CVE-2026-72195 fs/ntfs3: bound attr_off in UpdateResidentValue against data_off

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attroff in UpdateResidentValue against dataoff In doaction's UpdateResidentValue case fslog.c:3307, lrh-attroff and lrh-redolen come from the on-disk LRH. When they satisfy aoff + dlen res.dataoff, the assignment...

CVE-2026-72194

The CVE-2026-72194 issue affects the Linux kernel’s ntfs3 implementation. A depth-unlimited recursion in indx_find_buffer() when traversing the NTFS B+ tree can be triggered by mounting a malicious NTFS image and deleting a file whose index entry engages the rebalancing path, potentially causing ...

CVE-2026-72188 ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()

In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfslookupinodebyname ntfslookupinodebyname returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return an...

CVE-2026-72170 9p: skip nlink update in cacheless mode to fix WARN_ON

In the Linux kernel, the following vulnerability has been resolved: 9p: skip nlink update in cacheless mode to fix WARNON v9fsdeccount unconditionally calls dropnlink on regular files, even when the inode's nlink is already zero. In cacheless mode the client refetches inode metadata from the serv...

CVE-2026-72170

The CVE affects the Linux kernel 9p (9p/v9fs) implementation. In cacheless mode, v9fs_dec_count() unconditionally calls drop_nlink() on regular files, even when the inode’s nlink is already zero, because the client fetches inode metadata from the server (the source of truth) on every operation. T...

CVE-2026-72162

CVE-2026-72162 — In the Linux kernel OCFS2 code, a UBSAN array-index-out-of-bounds flaw occurs in ocfs2_sum_rightmost_rec when l_next_free_rec is 0 or exceeds l_count, indexing l_recs[] out of bounds. The root cause is computing i = le16_to_cpu(el->l_next_free_rec) - 1 without validating i. Th...

CVE-2026-72035

In the Linux kernel, the following vulnerability has been resolved: net/sched: schtaprio: Replace direct dequeue call with peek and qdiscdequeuepeeked When taprio's software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gsoskb; tapriodequeuefromtxq then tak...