CVE-2026-72155

CVE-2026-72155 concerns the Linux kernel driver mtd: spi-nor: swp, where unlocking the first- or early-blocks can fail when attempting to unlock only currently locked blocks. The root cause is that when both sides can achieve the same result (unlock everything), the lock_len logic misbehaved beca...

EUVD-2026-58911

In the Linux kernel, the following vulnerability has been resolved: irqchip/crossbar: Use correct index in crossbardomainfree crossbardomainfree resets the domain data and then uses the nulled out irqdata-hwirq member as index to reset the irqmap entry and to write the relevant crossbar register...

CVE-2026-72145

The documents confirm CVE-2026-72145 affects Linux kernel code in platform/x86/intel/tpmi. The mem_write() path now uses cleanup.h scope-based cleanup to automatically free a temporary array returned by parse_int_array_user(), ensuring release on all exit paths. The array declaration was moved ne...

CVE-2026-72143 platform/x86: ISST: Restore SST-PP control to all domains

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Restore SST-PP control to all domains The SST-PP control offset is only restored to power domain 0 after resume. During suspend, control values are read and stored for all power domains. Use pdinfo-sstbase...

CVE-2026-72143

CVE-2026-72143 (Linux kernel, platform/x86 ISST): Affected code path restores SST-PP control to all domains after resume. The bug is that the SST-PP control offset is restored incorrectly (only to power domain 0 after resume) while suspend stores control values for all domains. The fix changes us...

CVE-2026-72138 xen/gntdev: fix error handling in ioctl

In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: fix error handling in ioctl When gntdevioctlmapgrantref fails to copy the operation result back to userspace after successfully adding the mapping to the list, the error path returns -EFAULT without releasing the...

CVE-2026-72086 scsi: xen: scsiback: Free the command tag on the TMR submit-failure path

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...

CVE-2026-72086

The CVE-2026-72086 entry describes a Linux kernel vulnerability in the pvSCSI/scsiback path for Xen where, on the TMR submit-failure path, a command tag could be leaked instead of freed. Specifically, scsiback_device_action() obtains a tag, submits target_submit_tmr(), and on failure the err path...

CVE-2026-72077 Input: ims-pcu - fix firmware leak in async update

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix firmware leak in async update The firmware object was not being released if validation failed. Use freefirmware to ensure the firmware is always released...

CVE-2026-72059

Summary: The CVE-2026-72059 issue in the Linux kernel affects the wwan t7xx driver. During CLDMA late initialization, md_ctrl->gpd_dmapool is created before TX/RX rings are initialized. If a ring init fails, the code frees initialized rings but leaks the DMA pool. Consequence: potential DMA po...

EUVD-2026-59014

In the Linux kernel, the following vulnerability has been resolved: net: ena: clean up XDP TX queues when regular TX setup fails createqueueswithsizebackoff creates XDP TX queues before setting up the regular TX path. If the subsequent allocation or creation of regular TX queues fails, the error...

CVE-2026-72050

The CVE-2026-72050 entry concerns the Linux kernel subsystem octeontx2-af where BPID bitmap handling in setup is flawed. Specifically, nix_setup_bpids() allocates bp->bpids via rvu_alloc_bitmap() (using a plain kcalloc). If any subsequent devm_kcalloc() allocations for the BPID mapping arrays ...

CVE-2026-72032 net/mlx5: HWS, fix matcher leak on resize target setup failure

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, fix matcher leak on resize target setup failure hwsbwcmatchermove allocates a replacement matcher before setting it as the resize target. If mlx5hwsmatcherresizesettarget fails, the replacement matcher is not...

EUVD-2026-58989

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD The PNY CS900 1TB SSD Phison PS3111-S11, DRAM-less drops off the bus after entering Device-Initiated Slumber during idle. With the default medpowerwithdipm policy the link...

CVE-2026-72031

The CVE-2026-72031 entry concerns the Linux kernel (ata/libata-core) and a NOLPM quirk for the PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less). The vulnerability arises when Device-Initiated Slumber is entered during idle: under the default med_power_with_dipm policy the PCIe link drops (SStatus...

CVE-2026-72031 ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD The PNY CS900 1TB SSD Phison PS3111-S11, DRAM-less drops off the bus after entering Device-Initiated Slumber during idle. With the default medpowerwithdipm policy the link...

CVE-2026-72031 ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD The PNY CS900 1TB SSD Phison PS3111-S11, DRAM-less drops off the bus after entering Device-Initiated Slumber during idle. With the default medpowerwithdipm policy the link...

CVE-2026-72027

CVE-2026-72027 affects the Linux kernel in the memory management compaction path. The vulnerability stems from improper handling of the return value of free_pages_prepare() within compaction_free(); when free_pages_prepare() fails, compaction_free() may still add pages back into cc->freepages,...

CVE-2026-72027 mm/compaction: handle free_pages_prepare() properly in compaction_free()

In the Linux kernel, the following vulnerability has been resolved: mm/compaction: handle freepagesprepare properly in compactionfree freepagesprepare can fail but compactionfree does not handle the failure case. Failed pages should not be added back to cc-freepages for future use, since they can...

CVE-2026-72026 irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure

In the Linux kernel, the following vulnerability has been resolved: irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure imsicearlyacpiinit allocates a firmware node before setting up the IMSIC state. If imsicsetupstate fails, the function returns without freeing the allocated...