CVE-2026-72424

In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313rtcprobe calls devmrequestirq with IRQFSHARED and &pdev-dev as the cookie, but platformsetdrvdata is only called later after the clock setup. With a shared IRQ line...

CVE-2026-72388

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock Since dmafence objects can be shared with other subsystems, they may be accessed from hardirq context in those drivers, and we have to take that into...

CVE-2026-72384

In the Linux kernel, the following vulnerability has been resolved: irqchip/ts4800: Fix missing chained handler cleanup on remove The driver installs a chained handler for the parent interrupt during probe using irqsetchainedhandleranddata, but the remove function does not clear this handler. Thi...

CVE-2026-72324

In the Linux kernel, the following vulnerability has been resolved: gpio: mvebu: free generic chips on unbind irqallocdomaingenericchips allocates generic chip data that must be freed via irqdomainremovegenericchips. The devres action mvebugpioremoveirqdomain only called irqdomainremove, which on...

AZL-96126 CVE-2026-72324 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: gpio: mvebu: free generic chips on unbind irqallocdomaingenericchips allocates generic chip data that must be freed via irqdomainremovegenericchips. The devres action mvebugpioremoveirqdomain only called irqdomainremove, which on...

CVE-2026-74276

In the Linux kernel, the following vulnerability has been resolved: spi: xilinx: use FIFO occupancy register to determine buffer size The method the driver uses to determine the size of the FIFO has a problem. What it currently does is this: It stops the SPI hardware and writes to the TX FIFO...

UBUNTU-CVE-2026-72388

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock Since dmafence objects can be shared with other subsystems, they may be accessed from hardirq context in those drivers, and we have to take that into...

UBUNTU-CVE-2026-74276

In the Linux kernel, the following vulnerability has been resolved: spi: xilinx: use FIFO occupancy register to determine buffer size The method the driver uses to determine the size of the FIFO has a problem. What it currently does is this: It stops the SPI hardware and writes to the TX FIFO...

UBUNTU-CVE-2026-72454

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3chciaddrtodev i3chciaddrtodev walks bus-devs.i3c, which is protected by bus.lock rwsem. However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows concurrent...

UBUNTU-CVE-2026-72424

In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313rtcprobe calls devmrequestirq with IRQFSHARED and &pdev-dev as the cookie, but platformsetdrvdata is only called later after the clock setup. With a shared IRQ line...

CVE-2026-72424

In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313rtcprobe calls devmrequestirq with IRQFSHARED and &pdev-dev as the cookie, but platformsetdrvdata is only called later after the clock setup. With a shared IRQ line...

UBUNTU-CVE-2026-72409

In the Linux kernel, the following vulnerability has been resolved: net: mvneta: re-enable percpu interrupt on resume On Marvell MPIC platforms Armada 370/XP/38x, mvneta uses a percpu IRQ disable/enable scheme for NAPI: the ISR mvnetapercpuisr calls disablepercpuirq to mask the MPIC per-CPU...

UBUNTU-CVE-2026-74309

In the Linux kernel, the following vulnerability has been resolved: vdpa/octeonep: fix IRQ-to-ring mapping in interrupt handler Look up the IRQ index in octhw-irqs instead of assuming irq - irqs0. This supports non-contiguous IRQ numbers and avoids incorrect ring indexing when irqs0 is not the ba...

CVE-2026-72388

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock Since dmafence objects can be shared with other subsystems, they may be accessed from hardirq context in those drivers, and we have to take that into...

CVE-2026-72486

In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...

CVE-2026-72454

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3chciaddrtodev i3chciaddrtodev walks bus-devs.i3c, which is protected by bus.lock rwsem. However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows concurrent...

CVE-2026-74309

In the Linux kernel, the following vulnerability has been resolved: vdpa/octeonep: fix IRQ-to-ring mapping in interrupt handler Look up the IRQ index in octhw-irqs instead of assuming irq - irqs0. This supports non-contiguous IRQ numbers and avoids incorrect ring indexing when irqs0 is not the ba...

CVE-2026-72324

In the Linux kernel, the following vulnerability has been resolved: gpio: mvebu: free generic chips on unbind irqallocdomaingenericchips allocates generic chip data that must be freed via irqdomainremovegenericchips. The devres action mvebugpioremoveirqdomain only called irqdomainremove, which on...

UBUNTU-CVE-2026-72486

In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...

UBUNTU-CVE-2026-72026

In the Linux kernel, the following vulnerability has been resolved: irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure imsicearlyacpiinit allocates a firmware node before setting up the IMSIC state. If imsicsetupstate fails, the function returns without freeing the allocated...