CVE-2026-72212

In the Linux kernel, the following vulnerability has been resolved: mm/memoryhotplug: fix incorrect altmap passing in error path In createaltmapsandmemoryblocks, when archaddmemory succeeds with memmaponmemory enabled, the vmemmap pages are allocated from params.altmap. If creatememoryblockdevice...

CVE-2026-72199

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident index root values on lookup Resident $INDEXROOT values carry index header fields that callers consume after lookup. Some callers already validate parts of the layout before walking entries, but those check...

CVE-2026-72201

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index entries on reading Validate index entries immediately after reading an index root or index block from disk. This eliminates repeated checks in lookup and readdir, and reduce the risk of missing checks in thos...

CVE-2026-72178

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: always put unsuccessfully committed target pids damoncommittarget puts and gets the destination and the source target pids. It puts the destination target pid because it will be overwritten by the source target pid...

CVE-2026-72180

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: preserve pmdswpuffdwp on device-private PMD downgrade changenonpresenthugepmd rewrites a writable device-private PMD swap entry into a readable one without carrying pmdswpuffdwp across. The PTE-level...

CVE-2026-72181

In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASKOFFSTACK memory corruption This patch addresses a critical memory management flaw. When CONFIGCPUMASKOFFSTACK is enabled, cpumaskvart is a pointer. Consequently, sizeofnewmask evaluates to the pointer size...

CVE-2026-72182

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: fix refcount leak in isfullcharged In isfullcharged, powersupplygetbyname is called to obtain a reference to the fuelgauge power supply. If the voltage check uV = desc-fullbattuV succeeds, the...

CVE-2026-72184

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix hole runlist memory leak in insert range error path ntfsnonresidentattrinsertrange allocates holerl before mapping the whole runlist. If ntfsattrmapwholerunlist fails, the error path drops ni-runlist.lock and returns...

CVE-2026-72172

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: fix uninitialized struct pages for ZONEDEVICE If DAX memory is hotplugged into an unoccupied subsection of an early section, sectionactivate reuses the unoptimized boot memmap. However, compoundnrpages still assumes th...

CVE-2026-72175

In the Linux kernel, the following vulnerability has been resolved: fs/proc/taskmmu: fix makeuffdwphugepte prot-update race Patch series "userfaultfd/pagemap: pre-existing fixes". These are pre-existing bug fixes that were carried at the front of the userfaultfd RWP working-set-tracking series up...

CVE-2026-72176

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: put stats for schemeadddirs internal error damonsysfsschemeadddirs setup the triedregions directory after the stats directory setup is completed. When the triedregions directory setup is failed, the setup...

CVE-2026-72177

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: fix dir put orders in accesspatternadddirs Patch series "mm/damon/sysfs-schemes: fix wrong directories put orders in error paths". Error paths of damonsysfsaccesspatternadddirs and damonsysfsschemeadddirs...

CVE-2026-72171

In the Linux kernel, the following vulnerability has been resolved: mtd: slram: remove failed entries from the device list registerdevice links a new slrammtdlist entry before allocating all of the state needed by the entry. If a later allocation, memremap, or mtddeviceregister fails, the partial...

CVE-2026-72169

In the Linux kernel, the following vulnerability has been resolved: kho: make sure scratch size is always aligned by CMAMINALIGNMENTBYTES When using scratchscale, the scratch sizes are rounded up to CMAMINALIGNMENTBYTES since they will be released as MIGRATECMA. This is not done when using fixed...

CVE-2026-72168

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix fault in unaligned fixup Use kzallocobj / kzallocobjs to allocate the memcard structs, instead of kmallocobj / kmallocobjs to prevent access to uninitialized data. Fixes runtime error: Fault in unaligned...

CVE-2026-72153

In the Linux kernel, the following vulnerability has been resolved: irqchip/crossbar: Use correct index in crossbardomainfree crossbardomainfree resets the domain data and then uses the nulled out irqdata-hwirq member as index to reset the irqmap entry and to write the relevant crossbar register...

CVE-2026-72157

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags overflow by bounding framecount tbnetpoll assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment...

CVE-2026-72145

In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/tpmi: use cleanup helpers in memwrite In memwrite, the temporary array returned by parseintarrayuser must be released on all exit paths. Convert the array variable to use cleanup.h scope-based cleanup so it is...

CVE-2026-72146

In the Linux kernel, the following vulnerability has been resolved: dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Once the interrupt is requested, the interrupt handler may run immediately. Since the IRQ handler can access channel-chbase, which is initialized only afte...

CVE-2026-72150

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix uninitialized xprtcreateargs structure The xprtcreateargs structure is allocated on the stack without initialization in rpcsysfsxprtswitchaddxprtstore. While some fields are manually populated, critical fields like...