UBUNTU-CVE-2026-74412

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pcigetdrvdata type in AER handlers rtw88 stores an ieee80211hw pointer via pcisetdrvdata at probe time, but ioerrordetected and ioresume retrieve it as a netdevice pointer. This causes...

CVE-2026-72251

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnatsip: reload possible stale data pointer quoting sashiko: ------------------------------------------------------------------------ .. noticed a potential memory bug and header corruption involving the SIP NAT helpe...

CVE-2026-72111

In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register bounds before narrowing retval range in checkmemaccess When the BPF verifier processes a context load of an LSM hook return value, it calls markregs32range to narrow the register to the hook's valid range...

CVE-2026-72213

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch In allochugetlbfolio, a single hcg pointer is used for both the rsvd and non-rsvd hugetlb cgroup charges. When mapchg is set, hugetlbcgroupchargecgrouprsvd stores the...

CVE-2026-72106

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

UBUNTU-CVE-2026-72090

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

CVE-2026-72090

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

CVE-2026-72058

In the Linux kernel, the following vulnerability has been resolved: net: ixp4xxhss: fix duplicate HDLC netdev allocation ixp4xxhssprobe allocates two HDLC netdevs. The first one is stored in ndev, initialized, and registered with registerhdlcdevice. The second one is stored in port-netdev and lat...

CVE-2026-74413 wifi: rtw89: fix wrong pci_get_drvdata type in AER handlers

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix wrong pcigetdrvdata type in AER handlers rtw89 stores an ieee80211hw pointer via pcisetdrvdata at probe time, but ioerrordetected and ioresume retrieve it as a netdevice pointer. This causes...

CVE-2026-74412 wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pcigetdrvdata type in AER handlers rtw88 stores an ieee80211hw pointer via pcisetdrvdata at probe time, but ioerrordetected and ioresume retrieve it as a netdevice pointer. This causes...

CVE-2026-74412 wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pcigetdrvdata type in AER handlers rtw88 stores an ieee80211hw pointer via pcisetdrvdata at probe time, but ioerrordetected and ioresume retrieve it as a netdevice pointer. This causes...

EUVD-2026-59315

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftcompat: ebtables emulation must reject non-bridge targets xtables targets return netfilter verdicts: NFACCEPT, NFDROP, and so on. ebtables targets return incompatible verdicts: EBTACCEPT, EBTDROP, ... We cannot allo...

CVE-2026-72304 ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Fix TOCTOU in sofipc4bytesput In sofipc4bytesput, the copy size is derived from the old data-size in the buffer rather than the incoming new data's size field from ucontrol. If the new data has a differen...

EUVD-2026-58971

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch In allochugetlbfolio, a single hcg pointer is used for both the rsvd and non-rsvd hugetlb cgroup charges. When mapchg is set, hugetlbcgroupchargecgrouprsvd stores the...

CVE-2026-72159 ocfs2: reject non-inline dinodes with i_size and zero i_clusters

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject non-inline dinodes with isize and zero iclusters On a volume mounted without OCFS2FEATUREINCOMPATSPARSEALLOC, a non-inline regular file with non-zero isize and zero iclusters is structurally malformed: the extent ma...

CVE-2026-72095 dma-fence: Make dma_fence_dedup_array() robust against 0-count input

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Make dmafencededuparray robust against 0-count input dmafencededuparray returns 1 when called with numfences == 0: the for-loop body never executes, j stays at 0, and the final return ++j yields 1. This contradicts bot...

CVE-2026-72090 accel/amdxdna: Use caller client for debug BO sync

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

CVE-2026-72090

CVE-2026-72090 affects the Linux kernel component accel/amdxdna. The root cause is in the ioctl flow for SYNC_DIRECT_FROM_DEVICE: amdxdna_drm_sync_bo_ioctl() looked up args->handle in the caller’s drm_file and then invoked amdxdna_hwctx_sync_debug_bo() with abo->client. The function uses th...

CVE-2026-72090 accel/amdxdna: Use caller client for debug BO sync

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

CVE-2026-72058

Summary: The CVE-2026-72058 issue in the Linux kernel affects the ixp4xx_hss HDLC netdev allocation. In ixp4xx_hss_probe, two separate HDLC netdevs were allocated: the first was stored in ndev, initialized, and registered, while the second was stored in port->netdev and later used by the remov...