CVE-2026-72481

In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: ak8975: fix potential kernel stack memory leak Currently in the AK8975 driver there are four instances where potential uninitialized kernel stack memory leaks can occur. If i2csmbusreadi2cblockdataoremulated...

CVE-2026-72485

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...

CVE-2026-72470

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log-onepagebuf when adopting on-disk page size logreplay allocates log-onepagebuf using the page size that was chosen from the host PAGESIZE: log-onepagebuf = kmalloclog-pagesize, GFPNOFS; Later, when a restart...

CVE-2026-72478

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add bounds check to rungethighestvcn rungethighestvcn parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile UpdateMappingPairs record whose...

CVE-2026-72473

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decouple req recycling from RPC completion rlkref formerly served two distinct lifetimes through a single refcount: it gated when a Reply could wake its RPC task, and it gated when an rpcrdmareq could return to its free...

CVE-2026-72472

In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi-rwsem to protect traversal of the file lock list Lingfeng identified a bug and suggested two solutions, but both appear to have issues. Generally, we cannot release flclock while iterating over the file lock list to...

CVE-2026-72475

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: Properly free struct axidmacdesc Use axidmacfreedesc to free fully the descriptor at fail path when call axidmacallocdesc in axidmacprepperipheraldmavec...

CVE-2026-72476

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free In dmareleasechannel, check chan-device-privatecnt after call dmachanput. However, dmachanput call dmadeviceput which could release the last reference of the device if the DMA provider is...

CVE-2026-72462

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race in unix socket mediation when peerpath is used The holding a reference to the peersk is not enough to ensure access to the peer sk path. Accessing the path outside of the state lock allows for a race with...

CVE-2026-72467

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwrwpcreate during connect frwrwpcreate creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave...

CVE-2026-72469

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDRCHANGE rpcrdmacmeventhandler falls through to the disconnected: label on RDMACMEVENTADDRCHANGE and calls rpcrdmaepput with no matching get when the event arrives before RDMACMEVENTESTABLISHE...

CVE-2026-72461

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the skctx Currently updateskctx transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller conditionally put the referenc...

CVE-2026-72465

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The outnorqst exit in rpcrdmareplyhandler branches away before the credit clamp, so a reply that matches no pending request reaches outpost carrying the raw credit value...

CVE-2026-72463

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb-dev refcnt until after transportfinish. However, xfrmrcvcb may modify skb-dev to tunnel dev without taking device reference, such as vtircvcb. T...

CVE-2026-72466

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounded peek rpcrdmaisbcall decodes a reply's first words to decide whether the frame is a backchannel call. Two issues in that decode path let a short or malformed reply leak the receive buffer...

CVE-2026-72453

In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cacheops-populate callback, and if cache operations include an exit callback, the error code from...

CVE-2026-72460

In the Linux kernel, the following vulnerability has been resolved: apparmor: check label build before nonewprivs test aachangeprofile builds a replacement label with fnlabelbuildinscope before the nonewprivs subset check. The build helper can fail and return NULL or an ERRPTR, but the result was...

CVE-2026-72451

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrmstatelock. Thus it's possible for someone else to kill the state after it passed...

CVE-2026-72454

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3chciaddrtodev i3chciaddrtodev walks bus-devs.i3c, which is protected by bus.lock rwsem. However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows concurrent...

CVE-2026-72457

In the Linux kernel, the following vulnerability has been resolved: apparmor: fail policy unpack on accept2 allocation failure unpackpdb may need to allocate a missing ACCEPT2 table for older policy data. If that allocation failed, it set an error message but jumped to the success path, returning...