CVE-2026-72166

CVE-2026-72166 affects the Linux kernel’s 9p client RPC path. In p9_client_rpc() when handling P9_TFLUSH, a fatal signal could cause an infinite loop if the transport has no peer, due to clearing TIF_SIGPENDING before rechecking signal_pending_state. The fix adds a check for fatal_signal_pending(...

CVE-2026-72165

Technical details about CVE-2026-72165 are not publicly available in the provided documents. Monitor for updates; no specifics on affected products, versions, or fixes are available here.

CVE-2026-72165

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix condition in 'nandselecttarget' 'cs' here must be in range 0:nanddevntargets...

CVE-2026-72165 mtd: rawnand: fix condition in 'nand_select_target()'

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix condition in 'nandselecttarget' 'cs' here must be in range 0:nanddevntargets...

CVE-2026-72165 mtd: rawnand: fix condition in 'nand_select_target()'

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix condition in 'nandselecttarget' 'cs' here must be in range 0:nanddevntargets...

EUVD-2026-58923

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix condition in 'nandselecttarget' 'cs' here must be in range 0:nanddevntargets...

CVE-2026-72164

CVE-2026-72164: Linux kernel OCFS2 fix for moving extents to occupied clusters. The issue occurred during non-auto OCFS2_IOC_MOVE_EXT: a probe could leave a caller-controlled goal unchanged or misreport free runs, allowing data to be written into a cluster still owned by another inode. The patch ...

CVE-2026-72163

The vulnerability CVE-2026-72163 affects the Linux kernel OCFS2 journaling path. The issue arises in ocfs2_assure_trans_credits: when a journal aborts during DIO completion, a NULL h_transaction dereference can occur because the handle’s aborted state isn’t checked before reading remaining credit...

CVE-2026-72163

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL htransaction deref in ocfs2assuretranscredits BUG A direct write over unwritten extents can panic the kernel in ocfs2assuretranscredits when the journal aborts during DIO completion. The crash is a general...

CVE-2026-72164

In the Linux kernel, the following vulnerability has been resolved: ocfs2: avoid moving extents to occupied clusters For non-auto OCFS2IOCMOVEEXT operations, userspace supplies a physical megoal. ocfs2moveextent initializes newphyscpos from that goal and expects ocfs2probeallocgroup to replace it...

CVE-2026-72163 ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL htransaction deref in ocfs2assuretranscredits BUG A direct write over unwritten extents can panic the kernel in ocfs2assuretranscredits when the journal aborts during DIO completion. The crash is a general...

EUVD-2026-58921

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL htransaction deref in ocfs2assuretranscredits BUG A direct write over unwritten extents can panic the kernel in ocfs2assuretranscredits when the journal aborts during DIO completion. The crash is a general...

EUVD-2026-58922

In the Linux kernel, the following vulnerability has been resolved: ocfs2: avoid moving extents to occupied clusters For non-auto OCFS2IOCMOVEEXT operations, userspace supplies a physical megoal. ocfs2moveextent initializes newphyscpos from that goal and expects ocfs2probeallocgroup to replace it...

CVE-2026-72163 ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL htransaction deref in ocfs2assuretranscredits BUG A direct write over unwritten extents can panic the kernel in ocfs2assuretranscredits when the journal aborts during DIO completion. The crash is a general...

CVE-2026-72162 ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2sumrightmostrec BUG On-disk corruption setting lnextfreerec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. CAUSE...

CVE-2026-72162

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2sumrightmostrec BUG On-disk corruption setting lnextfreerec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. CAUSE...

CVE-2026-72162

CVE-2026-72162 — In the Linux kernel OCFS2 code, a UBSAN array-index-out-of-bounds flaw occurs in ocfs2_sum_rightmost_rec when l_next_free_rec is 0 or exceeds l_count, indexing l_recs[] out of bounds. The root cause is computing i = le16_to_cpu(el->l_next_free_rec) - 1 without validating i. Th...

EUVD-2026-58920

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2sumrightmostrec BUG On-disk corruption setting lnextfreerec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. CAUSE...

CVE-2026-72162 ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2sumrightmostrec BUG On-disk corruption setting lnextfreerec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. CAUSE...

CVE-2026-72161 ocfs2: add journal NULL check in ocfs2_checkpoint_inode()

In the Linux kernel, the following vulnerability has been resolved: ocfs2: add journal NULL check in ocfs2checkpointinode During unmount, ocfs2journalshutdown frees the journal and sets osb-journal to NULL. Later, when VFS evicts remaining cached inodes, ocfs2evictinode - ocfs2clearinode -...