CVE-2026-72038

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: fix BAR resource leak on PF number failure If cn23xxgetpfnum fails, the function returns without unmapping either BAR. Unmap both BARs before returning from the error path. Found by manual code review...

CVE-2026-72077

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix firmware leak in async update The firmware object was not being released if validation failed. Use freefirmware to ensure the firmware is always released...

CVE-2026-72207

In the Linux kernel, the following vulnerability has been resolved: ntfs: not change 0-byte $DATA attribute to non-resident When ntfsresidentattrresize cannot grow a resident attribute in place, it retries after converting other resident attributes to non-resident to free space in the MFT recrord...

CVE-2026-72244

In the Linux kernel, the following vulnerability has been resolved: gpu/buddy: bail out of tryharder when alignment cannot be honoured The tryharder contiguous fallback could return a range whose start offset did not match the caller's minblocksize. When a candidate's start is misaligned, realign...

UBUNTU-CVE-2026-72147

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma-pcie: Reject devices without driver data dwedmapcieprobe treats the PCI device ID driverdata as the template for the controller layout and copies it unconditionally. A device bound dynamically via sysfs can mat...

UBUNTU-CVE-2026-72016

In the Linux kernel, the following vulnerability has been resolved: cpu/hotplug: Fix NULL kobject warning in cpuhpsmtenable On arm64, when booting with maxcpus greater than the number of present CPUs e.g., QEMU -smp cpus=4,maxcpus=8, some CPUs are marked as 'present' but have not yet been...

UBUNTU-CVE-2026-72073

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: fix use-after-free on probe failure The vub300 driver lifetime-manages its controller state using vub300-kref, with vub300delete freeing the mmc host when the last reference is dropped. The probe error path after the...

UBUNTU-CVE-2026-72042

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmiallocrecvmsguser takes the temporary user reference owned by the receive message, and ipmifreerecvmsg drops it again. If event delivery fails after allocating receive messag...

UBUNTU-CVE-2026-72022

In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llcuiautobind llcuiautobind opens a SAP after choosing a dynamic LSAP. llcsapopen returns a reference owned by the caller, and llcsapaddsocket takes a second reference for the socket's membership in...

UBUNTU-CVE-2026-72280

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Drop bogus WARN for write to ZCREL2 It is entirely possible for a guest to write to the ZCREL2 sysreg alias while in a nested context, as it is expected if FEATNV2 is advertised to the L1 hypervisor. Get rid of th...

UBUNTU-CVE-2026-72228

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: fix primaryif leak on failed linearization If the skb has a fraglist, it must be linearized before it can be split using skbsplit. But when this step failed, it must not only free the skb but also take care of t...

UBUNTU-CVE-2026-72152

In the Linux kernel, the following vulnerability has been resolved: tpm: tpmtisspi: Use waitwoken in waitfortmpstat waiteventinterruptibletimeout evaluates its condition after setting the current task state to TASKINTERRUPTIBLE. With CONFIGDEBUGATOMICSLEEP this triggers a warning when the IRQ wai...

CVE-2026-72156

In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero headersize OOB read in mpfopsparseheader mpfopsparseheader reads headersize from the bitstream at MPFHEADERSIZEOFFSET 24. When headersize is zero, the expression buf + headersize - 1 reads one byte...

UBUNTU-CVE-2026-72125

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix use-after-free race with concurrent NETDEVUNREGISTER isotprelease looked up the bound network device via devgetbyindex using the stored ifindex. During device unregistration the device is unlisted from the ifindex...

UBUNTU-CVE-2026-72146

In the Linux kernel, the following vulnerability has been resolved: dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Once the interrupt is requested, the interrupt handler may run immediately. Since the IRQ handler can access channel-chbase, which is initialized only afte...

UBUNTU-CVE-2026-72247

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: fix zone comparison in tuple dedup The "already exists" dedup logic in nfconncountadd decides whether a connection has already been counted and can be skipped instead of incrementing the connlimit count. I...

UBUNTU-CVE-2026-72276

In the Linux kernel, the following vulnerability has been resolved: fbdev: metronomefb: fix potential memory leak in metronomefbprobe The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. Fix it by calling fbdeferrediocleanup...

UBUNTU-CVE-2026-72268

In the Linux kernel, the following vulnerability has been resolved: fbdev: tdfxfb: fix potential memory leak in tdfxfbprobe In tdfxfbprobe, the memory allocated for modelist using fbvideomodetomodelist when CONFIGFB3DFXI2C is defined, is not freed in the subsequent error paths. Fix that by callin...

UBUNTU-CVE-2026-72203

In the Linux kernel, the following vulnerability has been resolved: ntfs: skip extent mft records in writeback to prevent deadlock This patch fixes the ABBA deadlock between extentlock and extent mreclock triggered by xfstests generic/113, that occurs since the commit 6994acf33bae "ntfs: use base...

CVE-2026-72179

In the Linux kernel, the following vulnerability has been resolved: riscv: cacheinfo: Fix node reference leak in populatecacheleaves Currently, the while loop drops the reference to prev in each iteration. If the loop terminates early due to a break, the final ofnodeputnp correctly drops the...