CVE-2026-72368

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double unlock in nomemdalloc error path When startcreating fails and returns -ENOMEM, it has already released the parent directory lock in startdirop: static struct dentry startdirop... ... inodelocknesteddir,...

CVE-2026-72371

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFSVOLUMERMTREE is set on Fix afsinsertvolumeintocell to set AFSVOLUMERMTREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volume to be...

CVE-2026-72363

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio state after ENOMEM whilst under writeback iteration Fix the state of the current folio when ENOMEM occurs during writeback iteration. The folio needs to be redirtied and unlocked before the terminal writebackiter...

CVE-2026-72356

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifsissueread Fix missing release of credits in the failure path in cifsissueread lest retrying the subreq just overwrites the credits value...

CVE-2026-72359

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bomeminfo When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle...

CVE-2026-72362

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Fix NULL pointer dereference in xeptzapptesentry The page-table walk framework may pass a NULL child pointer for unpopulated entries. xeptzapptesentry called containerofchild before checking for NULL, then dereferenced...

CVE-2026-72361

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hwengine: Fix double-free of managed BO in error path The error path in hwengineinit explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup action...

CVE-2026-72339

In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on buildskb failure qederxbuildskb and qedetparxbuildskb do not check for a NULL return from qedebuildskb. When it returns NULL under memory pressure, the functions still consume a BD...

CVE-2026-72341

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix publication race for priv-channelstats mlx5echannelstatsalloc publishes a new entry to priv-channelstats and then increments priv-statsnch as a publication token, but neither store carries any memory barrier:...

CVE-2026-72343

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation mlx5ehvvhcastatscreate is called from mlx5enicenable, before mlx5eopen. At that point priv-statsnch is still zero, because it is only ever incremented in...

CVE-2026-72334

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last. If controller sends malformed sequence ISOSTA...

CVE-2026-72324

In the Linux kernel, the following vulnerability has been resolved: gpio: mvebu: free generic chips on unbind irqallocdomaingenericchips allocates generic chip data that must be freed via irqdomainremovegenericchips. The devres action mvebugpioremoveirqdomain only called irqdomainremove, which on...

CVE-2026-72321

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential memory leaks in igmpmodtimer and igmpstoptimer When a timer is deleted and not re-armed in igmpmodtimer, or stopped in igmpstoptimer, the code currently decrements the reference counter of the multicast...

CVE-2026-72308

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspportlagjoin When mlxswspportlagindexget fails, mlxswspportlagjoin returns an error without releasing the lag reference obtained by the earlier mlxswsplagget. All other error paths in the functio...

CVE-2026-72305

In the Linux kernel, the following vulnerability has been resolved: VDUSE: avoid leaking information to userspace The bounceing is not necessarily page aligned, so current VDUSE can leak kernel information through mapping bounce pages to userspace. Allocate bounce pages with GFPZERO to avoid...

CVE-2026-72309

In the Linux kernel, the following vulnerability has been resolved: tracing/remotes: Fix leak in traceremoteallocbuffer error path If page allocation fails in traceremoteallocbuffer, desc-nrcpus is not yet incremented for the current CPU. As a consequence, on error, half-allocated rbdesc will not...

CVE-2026-72311

In the Linux kernel, the following vulnerability has been resolved: drm/xe: free madvise VMA array on L2 flush failure xevmmadviseioctl allocates madviserange.vmas in getvmas. After getvmas succeeds with at least one VMA, error paths must go through freevmas so the array is released before the...

CVE-2026-72296

In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETHHLEN to be pullable in ifedecode ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes the decapsulated packet to ethtypetrans, which expects the inner...

CVE-2026-72301

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix TOCTOU in bytesput and bytesget In sofipc3bytesput, the size used for the memcpy is derived from the old data-size already in the buffer, not the incoming new data's size field. If the new data has a...

CVE-2026-72292

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Initialize KVMS390GETCMMABITS memory kvms390getcmmabits allocates its output buffer with vmalloc, which does not zero the returned pages: values = vmallocargs-count; In the non-peek migration path, datgetcmma reports a...