CVE-2026-72458

Summary: CVE-2026-72458 affects the Linux kernel (apparmor module) and is due to a NULL pointer dereference in unpack_pdb when pdb->dfa can be NULL if unpack_dfa fails. This could lead to a dereference vulnerability in apparmor paths. What’s affected: Linux kernel components implementing appar...

CVE-2026-72458 apparmor: fix NULL pointer dereference in unpack_pdb

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix NULL pointer dereference in unpackpdb pdb-dfa could be NULL if unpackdfa fails, causing a NULL pointer dereference...

CVE-2026-72458 apparmor: fix NULL pointer dereference in unpack_pdb

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix NULL pointer dereference in unpackpdb pdb-dfa could be NULL if unpackdfa fails, causing a NULL pointer dereference...

EUVD-2026-59357

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix NULL pointer dereference in unpackpdb pdb-dfa could be NULL if unpackdfa fails, causing a NULL pointer dereference...

CVE-2026-72457

In the Linux kernel, the AppArmor vulnerability arises during policy unpack when an ACCEPT2 table allocation fails. The function unpack_pdb() may need to allocate a missing ACCEPT2 table for older policy data; if the allocation fails, an error is set but execution continues to the success path, r...

CVE-2026-72455 apparmor: fix uninitialised pointer passed to audit_log_untrustedstring()

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to auditloguntrustedstring Commit 4a134723f9f1 "apparmor: move check for aanull file to cover all cases" intrdouced a small bug, where pathname may pass a potentially uninitialized name ...

EUVD-2026-59354

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to auditloguntrustedstring Commit 4a134723f9f1 "apparmor: move check for aanull file to cover all cases" intrdouced a small bug, where pathname may pass a potentially uninitialized name ...

CVE-2026-72455

The CVE-2026-72455 entry concerns the Linux kernel’s AppArmor path handling. A bug was introduced where path_name() could pass a potentially uninitialised name to aa_audit_file(), if the path’s dentry had been replaced with aa_null.dentry, triggering an audit path that could lead to a kernel page...

CVE-2026-72455 apparmor: fix uninitialised pointer passed to audit_log_untrustedstring()

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to auditloguntrustedstring Commit 4a134723f9f1 "apparmor: move check for aanull file to cover all cases" intrdouced a small bug, where pathname may pass a potentially uninitialized name ...

EUVD-2026-59352

In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cacheops-populate callback, and if cache operations include an exit callback, the error code from...

CVE-2026-72453

The CVE-2026-72453 issue affects the Linux kernel regcache initialization path. If an error occurs in the cache_ops->populate callback and the cache operations include an exit callback, the error code from populate() is overwritten by the exit() return value, hiding the real error from regcach...

CVE-2026-72453 regcache: Do not overwrite error code when finalizing cache after error

In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cacheops-populate callback, and if cache operations include an exit callback, the error code from...

CVE-2026-72453 regcache: Do not overwrite error code when finalizing cache after error

In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cacheops-populate callback, and if cache operations include an exit callback, the error code from...

CVE-2026-72448

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown The send-queue timestamp ring is allocated with qmemalloc when timestamping is used, but otx2freesqres never freed sq-timestamps, leaking that memory across ifdown and...

CVE-2026-72444

In the Linux kernel, the following vulnerability has been resolved: flowdissector: check device type before reading ETHADDRS skbflowdissect unconditionally reads 12 bytes from ethhdrskb when FLOWDISSECTORKEYETHADDRS is requested. This assumes the skb has a valid Ethernet header at macheader, whic...

CVE-2026-72432 tpm_crb: Check ACPI_COMPANION() against NULL during probe

In the Linux kernel, the following vulnerability has been resolved: tpmcrb: Check ACPICOMPANION against NULL during probe Every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, so platform drivers that rely on the...

CVE-2026-72432

Summary: CVE-2026-72432 affects the Linux kernel, specifically the tpm_crb driver. The issue arises when a device could be matched to a platform driver even if its ACPI companion is absent, due to device_match_driver_override(). Root cause: The probe path did not validate ACPI_COMPANION() for NUL...

CVE-2026-72429 ipv6: ioam: fix type confusion of dst_entry

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix type confusion of dstentry IOAM uses a dummy dstentrynulldst to mark that the destination should not be changed after the transformation. This dst is stored in the IOAM lwt state and may be passed to dstcachesetip...

EUVD-2026-59328

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix type confusion of dstentry IOAM uses a dummy dstentrynulldst to mark that the destination should not be changed after the transformation. This dst is stored in the IOAM lwt state and may be passed to dstcachesetip...

CVE-2026-72426 bpf: Preserve pointer spill metadata during half-slot cleanup

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer spill metadata during half-slot cleanup cleanfuncstate cleans dead stack slots in 4-byte halves. When the high half of a STACKSPILL slot is dead and the low half remains live, cleanup converts the live low...