CVE-2026-74271 power: supply: core: fix supplied_from allocations

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: fix suppliedfrom allocations If dts property power-supplies has multiple values, then accessing to psy-suppliedfromi-1 in powersupplypopulatesuppliedfrom will overrun suppliedfrom array...

CVE-2026-74256

Summary: CVE-2026-74256 concerns the Linux kernel’s BPF sockmap path where an integer overflow in bpf_msg_pop_data() bounds check can occur because start and len are 32-bit. The code computes a 64-bit last = start + len, but the current bounds check uses 32-bit arithmetic, allowing out-of-range s...

EUVD-2026-59403

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpfmsgpopdata bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l || las...

CVE-2026-74256 bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpfmsgpopdata bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l || las...

CVE-2026-72480

CVE-2026-72480 in the Linux kernel affects the IIO ADC Xilinx AMS driver. The vulnerability arises when ams_event_to_channel() returns a pointer past the end of dev->channels if no matching scan_index is found, potentially causing invalid memory access in ams_handle_event(). The fix adds a bou...

CVE-2026-72478 fs/ntfs3: add bounds check to run_get_highest_vcn()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add bounds check to rungethighestvcn rungethighestvcn parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile UpdateMappingPairs record whose...

CVE-2026-72470 fs/ntfs3: resize log->one_page_buf when adopting on-disk page size

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log-onepagebuf when adopting on-disk page size logreplay allocates log-onepagebuf using the page size that was chosen from the host PAGESIZE: log-onepagebuf = kmalloclog-pagesize, GFPNOFS; Later, when a restart...

EUVD-2026-59369

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log-onepagebuf when adopting on-disk page size logreplay allocates log-onepagebuf using the page size that was chosen from the host PAGESIZE: log-onepagebuf = kmalloclog-pagesize, GFPNOFS; Later, when a restart...

CVE-2026-72470

Summary: CVE-2026-72470 affects the Linux kernel ntfs3 driver. When mounting a dirty NTFS volume, log_replay() initially allocates log->one_page_buf using the host’s PAGE_SIZE, but if the on-disk page size is larger, the buffer is not grown. This can lead to reading log data into an undersized...

CVE-2026-72465

Summary (CVE-2026-72465) : In the Linux kernel, the xprtrdma subsystem (rpcrdma) had a credit handling bug. The reply credit grant could be parsed to an inflated value and, due to control flow, reach out_post without a proper clamp, allowing a reply for an unknown XID to drive refills and Receive...

CVE-2026-72450

CVE-2026-72450 affects the Linux kernel’s xfrm subsystem. Syzbot reported a shift-out-of-bounds in xfrm_selector_match when an AF_UNSPEC selector with a large prefixlen (e.g., 128) is matched against IPv4 flows under XFRM_STATE_AF_UNSPEC. The fix conceptually: (1) reject mismatched families in xf...

EUVD-2026-59349

In the Linux kernel, the following vulnerability has been resolved: xfrm: validate selector family and prefixlen during match syzbot reported a shift-out-of-bounds in xfrmselectormatch due to AFUNSPEC selector with large prefixlen e.g. 128 matched against IPv4 flow when XFRMSTATEAFUNSPEC is set...

CVE-2026-72415 ASoC: SDCA: Validate written enum value in ge_put_enum_double()

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Validate written enum value in geputenumdouble geputenumdouble passes the user-supplied enumeration index item0 to sndsocenumitemtoval without checking it against the number of items in the enum: ret =...

CVE-2026-72398 sctp: add INIT verification after cookie unpacking

In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried in INIT-ACK. The client then returns this cookie via COOKIE-ECHO, wher...

CVE-2026-72399 net: enetc: check the number of BDs needed for xdp_frame

In the Linux kernel, the following vulnerability has been resolved: net: enetc: check the number of BDs needed for xdpframe The size of xdpredirectarr array is ENETCMAXSKBFRAGS. However, the number of fragments contained in xdpframe may be greater than or equal to ENETCMAXSKBFRAGS, which will cau...

CVE-2026-72399

CVE-2026-72399 affects the Linux kernel net/enetc driver. The bug stems from an out-of-bounds access to xdp_redirect_arr, where the array is ENETC_MAX_SKB_FRAGS large but xdp_frame fragments may be ≥ that size. The vulnerability has been resolved in the Linux kernel according to the provided sour...

CVE-2026-72395

CVE-2026-72395 fixes a Linux kernel hwmon/pmbus issue where a worker batcher passed a combined bitmask of regulator events to regulator_notifier_call_chain(), causing regulator_handle_critical() to miss a valid case when multiple faults occurred before the worker ran. The strict switch in regulat...

EUVD-2026-59281

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

CVE-2026-72380

CVE-2026-72380 affects the Linux kernel xen/pvcalls front-end. The issue arises when pvcalls_front_event_handler() uses the backend-supplied req_id (from the ring) to index bedata->rsp[] without a proper range check, allowing an out-of-bounds write if req_id exceeds PVCALLS_NR_RSP_PER_RING. Ad...

EUVD-2026-59275

In the Linux kernel, the following vulnerability has been resolved: afs: Fix misplaced inc of net-cellsoutstanding Fix net-cellsoutstanding being incremented before the check for failure of idralloccyclic, leaving the count incremented on error...