CVE-2026-72253

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: validate skbdst before accessing it tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relies o...

EUVD-2026-58963

In the Linux kernel, the following vulnerability has been resolved: ntfs: free volume-wide resources on fillsuper failure ntfsfillsuper's erroutnow path frees only the volume struct via kfreevol, leaving several vol-owned allocations behind on every mount failure: - vol-nlsmap, loaded by...

CVE-2026-72205 ntfs: free volume-wide resources on fill_super failure

In the Linux kernel, the following vulnerability has been resolved: ntfs: free volume-wide resources on fillsuper failure ntfsfillsuper's erroutnow path frees only the volume struct via kfreevol, leaving several vol-owned allocations behind on every mount failure: - vol-nlsmap, loaded by...

CVE-2026-72205

In the Linux kernel, the following vulnerability has been resolved: ntfs: free volume-wide resources on fillsuper failure ntfsfillsuper's erroutnow path frees only the volume struct via kfreevol, leaving several vol-owned allocations behind on every mount failure: - vol-nlsmap, loaded by...

CVE-2026-72205 ntfs: free volume-wide resources on fill_super failure

In the Linux kernel, the following vulnerability has been resolved: ntfs: free volume-wide resources on fillsuper failure ntfsfillsuper's erroutnow path frees only the volume struct via kfreevol, leaving several vol-owned allocations behind on every mount failure: - vol-nlsmap, loaded by...

CVE-2026-72205

The CVE-2026-72205 entry concerns a Linux kernel ntfs mount failure leak: on fill_super error paths, vol-owned allocations (nls_map, volume_label) and lcn_empty_bits_per_page were not freed, leading to per‑mount leaks until module unload. The issue affects ntfs_fill_super() and err_out_now paths,...

CVE-2026-72205

In the Linux kernel, the following vulnerability has been resolved: ntfs: free volume-wide resources on fillsuper failure ntfsfillsuper's erroutnow path frees only the volume struct via kfreevol, leaving several vol-owned allocations behind on every mount failure: - vol-nlsmap, loaded by...

EUVD-2026-58925

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: pl353: fix probe resource allocation During probe, the devmioremap is called with the parent device instead of the current one. So when the module is unloaded, the register area isn't released. Target the pl35x devi...

CVE-2026-72167

CVE-2026-72167 concerns the Linux kernel: a fix for the mtd: rawnand: pl353 issue where, during probe(), devm_ioremap() used the parent device instead of the current one, preventing the register area from being released on module unload. The remediation is to target the pl35x device in devm_iorem...

CVE-2026-72167 mtd: rawnand: pl353: fix probe resource allocation

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: pl353: fix probe resource allocation During probe, the devmioremap is called with the parent device instead of the current one. So when the module is unloaded, the register area isn't released. Target the pl35x devi...

CVE-2026-72167

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: pl353: fix probe resource allocation During probe, the devmioremap is called with the parent device instead of the current one. So when the module is unloaded, the register area isn't released. Target the pl35x devi...

CVE-2026-72167 mtd: rawnand: pl353: fix probe resource allocation

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: pl353: fix probe resource allocation During probe, the devmioremap is called with the parent device instead of the current one. So when the module is unloaded, the register area isn't released. Target the pl35x devi...

CVE-2026-72154 openrisc: Fix jump_label smp syncing

In the Linux kernel, the following vulnerability has been resolved: openrisc: Fix jumplabel smp syncing The original commit 8c30b0018f9d "openrisc: Add jump label support" copies from arm64 and does not properly consider how icache invalidation on remote cores works in OpenRISC. On OpenRISC remot...

CVE-2026-72154

CVE-2026-72154 describes a Linux kernel vulnerability in the OpenRISC path related to jump_label SMP cache syncing. The issue arose from an OpenRISC-specific implementation that copied from arm64 and didn’t correctly handle icache invalidation on remote cores, which could leave stale static_key c...

EUVD-2026-58912

In the Linux kernel, the following vulnerability has been resolved: openrisc: Fix jumplabel smp syncing The original commit 8c30b0018f9d "openrisc: Add jump label support" copies from arm64 and does not properly consider how icache invalidation on remote cores works in OpenRISC. On OpenRISC remot...

CVE-2026-72154 openrisc: Fix jump_label smp syncing

In the Linux kernel, the following vulnerability has been resolved: openrisc: Fix jumplabel smp syncing The original commit 8c30b0018f9d "openrisc: Add jump label support" copies from arm64 and does not properly consider how icache invalidation on remote cores works in OpenRISC. On OpenRISC remot...

CVE-2026-72154

In the Linux kernel, the following vulnerability has been resolved: openrisc: Fix jumplabel smp syncing The original commit 8c30b0018f9d "openrisc: Add jump label support" copies from arm64 and does not properly consider how icache invalidation on remote cores works in OpenRISC. On OpenRISC remot...

EUVD-2026-58899

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 IRQ SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next...

CVE-2026-72141

CVE-2026-72141 covers a Linux kernel issue in the i2c/imx SMBus path where a Block Read with a count of 0 could cause the bus to stay locked. The vulnerability arises because the interrupt-driven state machine incorrectly handles -EPROTO for a zero-byte block read, failing to issue a NACK+STOP an...

CVE-2026-72141 i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ)

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 IRQ SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next...