CVE-2026-72490 staging: rtl8723bs: fix stainfo check in rtw_aes_decrypt

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtwaesdecrypt The null-pointer-guard was incorrect, returning FAIL on valid pointer. Invert the guard, so it returns FAIL on invalid pointer...

CVE-2026-72490 staging: rtl8723bs: fix stainfo check in rtw_aes_decrypt

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtwaesdecrypt The null-pointer-guard was incorrect, returning FAIL on valid pointer. Invert the guard, so it returns FAIL on invalid pointer...

CVE-2026-72490

The CVE-2026-72490 entry concerns the Linux kernel (staging: rtl8723bs) with a fix to the stainfo check in rtw_aes_decrypt. The issue was an incorrect null-pointer guard that returned _FAIL on a valid pointer; the guard was inverted so that it now returns _FAIL on invalid pointers. This change re...

EUVD-2026-59388

In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvecrxcompleted In nvecrxcompleted, when an incomplete RX transfer is detected, nvecmsgfree is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately aft...

EUVD-2026-59387

In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdwaddelementgroupcount found by syzkaller The original implementation caused an out-of-bounds memory access in the sdwaddelementgroupcount for-loop when i == num. for i = 0; i ratesi && lane == group-lanesi...

CVE-2026-72488 soundwire: fix bug in sdw_add_element_group_count found by syzkaller

In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdwaddelementgroupcount found by syzkaller The original implementation caused an out-of-bounds memory access in the sdwaddelementgroupcount for-loop when i == num. for i = 0; i ratesi && lane == group-lanesi...

CVE-2026-72488 soundwire: fix bug in sdw_add_element_group_count found by syzkaller

In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdwaddelementgroupcount found by syzkaller The original implementation caused an out-of-bounds memory access in the sdwaddelementgroupcount for-loop when i == num. for i = 0; i ratesi && lane == group-lanesi...

CVE-2026-72489 staging: nvec: fix use-after-free in nvec_rx_completed()

In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvecrxcompleted In nvecrxcompleted, when an incomplete RX transfer is detected, nvecmsgfree is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately aft...

CVE-2026-72488

In the Linux kernel, the soundwire subsystem fixed an out-of-bounds memory access in the sdw_add_element_group_count loop when i == num. The vulnerable code used for (i = 0; i rates[i]/group->lanes[i]. The patch adds a pre-check to verify existing rate/lane entries in the target group before i...

CVE-2026-72489

The CVE-2026-72489 issue affects the Linux kernel staging/nvec code. In nvec_rx_completed(), an incomplete RX transfer could trigger nvec_msg_free() to clear a pool slot, after which the code reads nvec->rx->data[0]. Because the slot may be reallocated concurrently, this leads to a use-afte...

CVE-2026-72489

In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvecrxcompleted In nvecrxcompleted, when an incomplete RX transfer is detected, nvecmsgfree is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately aft...

CVE-2026-72488

In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdwaddelementgroupcount found by syzkaller The original implementation caused an out-of-bounds memory access in the sdwaddelementgroupcount for-loop when i == num. for i = 0; i ratesi && lane == group-lanesi...

EUVD-2026-59386

In the Linux kernel, the following vulnerability has been resolved: PCI: Check ROM header and data structure addr before accessing We meet a crash when running stress-ng on x8664 machine: BUG: unable to handle page fault for address: ffa0000007f40000 RIP: 0010:pcigetromsize+0x52/0x220 Call Trace:...

CVE-2026-72487 PCI: Check ROM header and data structure addr before accessing

In the Linux kernel, the following vulnerability has been resolved: PCI: Check ROM header and data structure addr before accessing We meet a crash when running stress-ng on x8664 machine: BUG: unable to handle page fault for address: ffa0000007f40000 RIP: 0010:pcigetromsize+0x52/0x220 Call Trace:...

CVE-2026-72487 PCI: Check ROM header and data structure addr before accessing

In the Linux kernel, the following vulnerability has been resolved: PCI: Check ROM header and data structure addr before accessing We meet a crash when running stress-ng on x8664 machine: BUG: unable to handle page fault for address: ffa0000007f40000 RIP: 0010:pcigetromsize+0x52/0x220 Call Trace:...

CVE-2026-72487

The CVE describes a Linux kernel PCI ROM access vulnerability in the PCI subsystem that caused crashes when reading ROM data if the ROM space address/size checks are missing. Concrete details in the connected records show: the ROM space started at 0xffa0000007f30000 with size 0x10000, and a readl...

CVE-2026-72487

In the Linux kernel, the following vulnerability has been resolved: PCI: Check ROM header and data structure addr before accessing We meet a crash when running stress-ng on x8664 machine: BUG: unable to handle page fault for address: ffa0000007f40000 RIP: 0010:pcigetromsize+0x52/0x220 Call Trace:...

EUVD-2026-59384

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...

CVE-2026-72486 mailbox: mtk-adsp: fix UAF during device teardown

In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...

CVE-2026-72485

CVE-2026-72485 describes a Linux kernel vulnerability in the coresight platform where nr_outconns/nr_inconns were incremented before allocations, causing a premature counter bump and potential panics during cleanup when allocations failed. The issue affects the coresight_add_out_conn() and coresi...