CVE-2026-72264

The CVE-2026-72264 issue is in the Linux kernel’s fbdev/tridentfb code. In trident_pci_probe(), memory allocated for a modelist via fb_videomode_to_modelist() may not be freed along error paths, creating a potential memory leak. The fix ensures the modelist is destroyed with fb_destroy_modelist()...

CVE-2026-72263 ASoC: SOF: topology: fix memory leak in snd_sof_load_topology

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: fix memory leak in sndsofloadtopology When the topology filename contains "dummy" and tplgcnt is 0, the function returns -EINVAL directly without freeing the tplgfiles allocated by kcalloc at line 2497. This...

CVE-2026-72264

In the Linux kernel, the following vulnerability has been resolved: fbdev: tridentfb: fix potential memory leak in tridentpciprobe In tridentpciprobe, the memory allocated for modelist using fbvideomodetomodelist is not freed in subsequent error paths. Fix that by calling fbdestroymodelist...

EUVD-2026-59160

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in sndsofupdatecontrol In sndsofupdatecontrol, firmware-provided cdata-numelems is checked against localcdata-data-size but never against the actual allocation size. If localcdata-data-size...

EUVD-2026-59161

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

CVE-2026-72261

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in sndsofupdatecontrol In sndsofupdatecontrol, firmware-provided cdata-numelems is checked against localcdata-data-size but never against the actual allocation size. If localcdata-data-size...

CVE-2026-72261 ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in sndsofupdatecontrol In sndsofupdatecontrol, firmware-provided cdata-numelems is checked against localcdata-data-size but never against the actual allocation size. If localcdata-data-size...

CVE-2026-72261 ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in sndsofupdatecontrol In sndsofupdatecontrol, firmware-provided cdata-numelems is checked against localcdata-data-size but never against the actual allocation size. If localcdata-data-size...

CVE-2026-72262 ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

CVE-2026-72262

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

CVE-2026-72261

Summary: CVE-2026-72261 affects the Linux kernel ASoC: SOF ipc3-control path. In snd_sof_update_control, the code validates firmware-provided cdata->num_elems against local_cdata->data->size but does not verify it against the actual allocation size. If local_cdata->data->size was p...

CVE-2026-72262

CVE-2026-72262 : In the Linux kernel ASoC SOF ipc3-control pathway, there is a heap overflow in bytes_ext_put/get due to incorrect bounds checks on the ipc_control_data buffer. The cdata->data payload sits after the struct and max_size was evaluated against the entire allocation, allowing writ...

CVE-2026-72262 ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

CVE-2026-72260 ASoC: mediatek: mt8192: Check runtime resume during probe

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Check runtime resume during probe The MT8192 AFE probe enables runtime PM temporarily while reinitializing the regmap cache from hardware, but it uses pmruntimegetsync without checking the return value. If...

CVE-2026-72260 ASoC: mediatek: mt8192: Check runtime resume during probe

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Check runtime resume during probe The MT8192 AFE probe enables runtime PM temporarily while reinitializing the regmap cache from hardware, but it uses pmruntimegetsync without checking the return value. If...

CVE-2026-72260

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Check runtime resume during probe The MT8192 AFE probe enables runtime PM temporarily while reinitializing the regmap cache from hardware, but it uses pmruntimegetsync without checking the return value. If...

CVE-2026-72260

CVE-2026-72260 (Linux kernel, ASoC MT8192) : The vulnerability arises in the MT8192 AFE probe where runtime PM is enabled during regmap cache reinitialization and pm_runtime_get_sync() is called without validating its return value. If runtime resume fails, the probe continues, potentially leaving...

EUVD-2026-59159

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Check runtime resume during probe The MT8192 AFE probe enables runtime PM temporarily while reinitializing the regmap cache from hardware, but it uses pmruntimegetsync without checking the return value. If...

CVE-2026-72259

In the Linux kernel ASoC: mediatek mt8192 driver, reserved memory assigned during MT8192 AFE probe was not released on success. The issue is fixed by registering a devm cleanup action so the reserved-memory assignment is released on probe failure or driver unbind. This mode highlights the specifi...

CVE-2026-72259 ASoC: mediatek: mt8192: Release reserved memory on cleanup

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Release reserved memory on cleanup The MT8192 AFE probe calls ofreservedmemdeviceinit and falls back to preallocated buffers when no reserved memory region is available. When the reserved memory assignment...