CVE-2026-72351 gue: validate REMCSUM private option length

In the Linux kernel, the following vulnerability has been resolved: gue: validate REMCSUM private option length GUE private flags can indicate that remote checksum offload metadata is present. The private flags field itself is accounted for by guehdrflagslen, but guehdrprivflagslen currently...

CVE-2026-72351

CVE-2026-72351 : In the Linux kernel, the vulnerability concerns GUE private flags indicating REMCSUM metadata. The root cause is that guehdr_priv_flags_len() returns 0 when GUE_PFLAG_REMCSUM is set, allowing a packet with only the private flags field to pass validate_gue_flags(). Consequently, g...

CVE-2026-72310

CVE-2026-72310 : In the Linux kernel SMB client, the passthrough ioctl bounds check for smb2_ioctl_query_info() uses 32-bit fields for OutputOffset and input_buffer_length. The code adds these values directly, allowing 32-bit wrap-around, which can let a malicious server craft a large OutputOffse...

CVE-2026-72302

The CVE-2026-72302 entry documents a Linux kernel flaw in ASoC: SOF ipc3-control where sof_ipc3_control_update() used firmware-provided cdata->num_elems in arithmetic that could overflow on 32-bit platforms. This overflow could let cdata->rhdr.hdr.size comparisons pass with mismatched sizes...

CVE-2026-72300 ASoC: SOF: topology: validate vendor array size before parsing

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

EUVD-2026-59184

In the Linux kernel, the following vulnerability has been resolved: KVM: TDX: Reject concurrent change to CPUID entry count Reject KVMTDXINITVM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data. tdxtdinit first reads userdata-cpuid.nent to...

CVE-2026-72285 KVM: TDX: Reject concurrent change to CPUID entry count

In the Linux kernel, the following vulnerability has been resolved: KVM: TDX: Reject concurrent change to CPUID entry count Reject KVMTDXINITVM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data. tdxtdinit first reads userdata-cpuid.nent to...

CVE-2026-72232

CVE-2026-72232 relates to the Linux kernel/batman-adv stack, where a local user with eBPF TC hook access could trigger a packet truncation that redirects to a batman-adv interface. The vulnerability arises because the code assumes at least ETH_HLEN bytes are available and may read beyond the buff...

CVE-2026-72232 batman-adv: ensure minimal ethernet header on TX

In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 "net: bridge: xmit: make sure we have at least eth header len bytes", it is possible by for a local user with eBPF TC hook access to attach a t...

EUVD-2026-58968

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one in mapping pairs decoding bounds checks In ntfsmappingpairsdecompress, attrend points one byte past the end of the attribute record: attrend = u8 attr + le32tocpuattr-length; The two bounds checks validating...

EUVD-2026-58966

In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfsealookup and ntfslistxattr, this verifies that there is enough space in the EA entry before accessing the nextentryoffset field of the EA entry...

CVE-2026-72129

The CVE describes a Linux kernel nvmet-rdma issue: when inline_data_size exceeds PAGE_SIZE, an offset in (PAGE_SIZE, inline_data_size] causes PAGE_SIZE - off to underflow, making sg->length effectively 4 GiB and allowing reading past the first inline page. The root cause is that the mapping as...

EUVD-2026-59047

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fwlogfrombo validates the tracing buffer headersize and that the log fits within the BO, but never checks that log-size is at least log-headersize. fwlogprintbuffer th...

CVE-2026-72089 accel/ivpu: Reject firmware log with size smaller than header

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fwlogfrombo validates the tracing buffer headersize and that the log fits within the BO, but never checks that log-size is at least log-headersize. fwlogprintbuffer th...

CVE-2026-72084 scsi: target: Bound PR-OUT TransportID parsing to the received buffer

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer corescsi3decodespeciport and corescsi3emulateregisterandmove hand the raw PERSISTENT RESERVE OUT parameter buffer to targetparseprouttransportid without tellin...

EUVD-2026-59042

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer corescsi3decodespeciport and corescsi3emulateregisterandmove hand the raw PERSISTENT RESERVE OUT parameter buffer to targetparseprouttransportid without tellin...

CVE-2026-72084 scsi: target: Bound PR-OUT TransportID parsing to the received buffer

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer corescsi3decodespeciport and corescsi3emulateregisterandmove hand the raw PERSISTENT RESERVE OUT parameter buffer to targetparseprouttransportid without tellin...

CVE-2026-72019

CVE-2026-72019 affects the Linux kernel macsec path: macsec_encrypt() reads the Ethernet header via eth_hdr(skb) when skb->mac_header is unset on AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS, causing a 12-byte heap over-read and the frame’s outer MAC to be read on the wire. The issue occurs becaus...

EUVD-2026-58977

In the Linux kernel, the following vulnerability has been resolved: macsec: don't read an unset MAC header in macsecencrypt macsecencrypt reads the Ethernet header via ethhdrskb skb-head + skb-macheader to memmove the 12 source/destination MAC bytes forward and make room for the SecTAG. On the...

CVE-2026-72019 macsec: don't read an unset MAC header in macsec_encrypt()

In the Linux kernel, the following vulnerability has been resolved: macsec: don't read an unset MAC header in macsecencrypt macsecencrypt reads the Ethernet header via ethhdrskb skb-head + skb-macheader to memmove the 12 source/destination MAC bytes forward and make room for the SecTAG. On the...