CVE-2026-74285 net: Stop leased rxq before uninstalling its memory provider

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netifrxqcleanupunlease tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA...

CVE-2026-72379 fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid

In the Linux kernel, the following vulnerability has been resolved: fs: refuse OTMPFILE creation with an unmapped fsuid or fsgid vfstmpfile never checked that the caller's fsuid and fsgid map into the filesystem. On an idmapped mount whose idmapping does not cover the caller's fsu,gid, the -tmpfi...

CVE-2026-72379 fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid

In the Linux kernel, the following vulnerability has been resolved: fs: refuse OTMPFILE creation with an unmapped fsuid or fsgid vfstmpfile never checked that the caller's fsuid and fsgid map into the filesystem. On an idmapped mount whose idmapping does not cover the caller's fsu,gid, the -tmpfi...

EUVD-2026-59278

In the Linux kernel, the following vulnerability has been resolved: fs: refuse OTMPFILE creation with an unmapped fsuid or fsgid vfstmpfile never checked that the caller's fsuid and fsgid map into the filesystem. On an idmapped mount whose idmapping does not cover the caller's fsu,gid, the -tmpfi...

EUVD-2026-59178

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backi...

CVE-2026-72279 KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backi...

EUVD-2026-59176

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the...

CVE-2026-72210 ntfs: fix off-by-one in mapping pairs decoding bounds checks

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one in mapping pairs decoding bounds checks In ntfsmappingpairsdecompress, attrend points one byte past the end of the attribute record: attrend = u8 attr + le32tocpuattr-length; The two bounds checks validating...

EUVD-2026-58958

In the Linux kernel, the following vulnerability has been resolved: ntfs: detect mapping-pairs LCN accumulator overflow The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range. One corrupt runlis...

CVE-2026-72200 ntfs: detect mapping-pairs LCN accumulator overflow

In the Linux kernel, the following vulnerability has been resolved: ntfs: detect mapping-pairs LCN accumulator overflow The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range. One corrupt runlis...

EUVD-2026-59046

In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path If physdisk-inreset is set, the function returns directly without undoing the resources acquired for the command. Add the missing error cleanup by unmapping the IOACCEL2 SG...

CVE-2026-72088 scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path

In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path If physdisk-inreset is set, the function returns directly without undoing the resources acquired for the command. Add the missing error cleanup by unmapping the IOACCEL2 SG...

PT-2026-72794

In the Linux kernel, the following vulnerability has been resolved: ext4: fix fast commit wait/wake bit mapping on 64-bit On 64-bit, ext4 dynamic inode states live in the upper half of i flags, and ext4 test inode state applies the corresponding +32 offset. The fast-commit wait and wake paths...

PT-2026-72832

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure mlx5r umr update xlt allocates and DMA maps an XLT buffer with mlx5r umr create xlt. The buffer is released by the common cleanup path through mlx5r umr unmap free xlt. After...

PT-2026-72745

In the Linux kernel, the following vulnerability has been resolved: vdpa/octeon ep: fix IRQ-to-ring mapping in interrupt handler Look up the IRQ index in oct hw-irqs instead of assuming irq - irqs0. This supports non-contiguous IRQ numbers and avoids incorrect ring indexing when irqs0 is not the...

PT-2026-72398

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one in mapping pairs decoding bounds checks In ntfs mapping pairs decompress, attr end points one byte past the end of the attribute record: attr end = u8 attr + le32 to cpuattr-length; The two bounds checks...

PT-2026-72721

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netif rxq cleanup unlease tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA...

PT-2026-72388

In the Linux kernel, the following vulnerability has been resolved: ntfs: detect mapping-pairs LCN accumulator overflow The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range. One corrupt runlis...

PT-2026-72816

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommu map sgtable return value check Commit "iommu: return full error code from iommu map sg atomic" changed iommu map sgtable to return an ssize t and negative values in error cases, rather than a size t and a...

PT-2026-72277

In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path If phys disk-in reset is set, the function returns directly without undoing the resources acquired for the command. Add the missing error cleanup by unmapping the IOACCEL2 S...