CVE-2026-74505

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Fix UAF at error handling during probe Although 6fire driver had a few fixes for dealing with the early error handling during the probe phase, it forgot a pending URB before freeing the resources, which may lead to a...

CVE-2026-72432 tpm_crb: Check ACPI_COMPANION() against NULL during probe

In the Linux kernel, the following vulnerability has been resolved: tpmcrb: Check ACPICOMPANION against NULL during probe Every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, so platform drivers that rely on the...

CVE-2026-72276 fbdev: metronomefb: fix potential memory leak in metronomefb_probe()

In the Linux kernel, the following vulnerability has been resolved: fbdev: metronomefb: fix potential memory leak in metronomefbprobe The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. Fix it by calling fbdeferrediocleanup...

CVE-2026-72275

The CVE concerns the Linux kernel fbdev driver for broadsheetfb. A memory leak was introduced where pagerefs allocated in fb_deferred_io_init() were not freed on error paths in broadsheetfb_probe(). The issue is fixed by invoking fb_deferred_io_cleanup() to release the allocated resources. The do...

CVE-2026-72271 fbdev: i740fb: fix potential memory leak in i740fb_probe()

In the Linux kernel, the following vulnerability has been resolved: fbdev: i740fb: fix potential memory leak in i740fbprobe In i740fbprobe, the memory allocated in fbvideomodetomodelist for modelist is not freed in the error paths. Fix that by calling fbdestroymodelist...

CVE-2026-72268 fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()

In the Linux kernel, the following vulnerability has been resolved: fbdev: tdfxfb: fix potential memory leak in tdfxfbprobe In tdfxfbprobe, the memory allocated for modelist using fbvideomodetomodelist when CONFIGFB3DFXI2C is defined, is not freed in the subsequent error paths. Fix that by callin...

CVE-2026-72260

CVE-2026-72260 (Linux kernel, ASoC MT8192) : The vulnerability arises in the MT8192 AFE probe where runtime PM is enabled during regmap cache reinitialization and pm_runtime_get_sync() is called without validating its return value. If runtime resume fails, the probe continues, potentially leaving...

CVE-2026-72167 mtd: rawnand: pl353: fix probe resource allocation

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: pl353: fix probe resource allocation During probe, the devmioremap is called with the parent device instead of the current one. So when the module is unloaded, the register area isn't released. Target the pl35x devi...

CVE-2026-68467 mtd: mchp23k256: use SPI match data for chip caps

In the Linux kernel, the following vulnerability has been resolved: mtd: mchp23k256: use SPI match data for chip caps The driver stores chip capacity information in both the OF match table and the SPI id table. Probe currently uses ofdevicegetmatchdata, so a non-OF SPI modalias match falls back t...

PT-2026-72461

In the Linux kernel, the following vulnerability has been resolved: fbdev: efifb: fix memory leak in efifb probe Since commit 73ce73c30ba9 "fbdev: Transfer video= option strings to caller; clarify ownership" the string returned from fb get options is expected to be freed by the caller, but the...

PT-2026-72463

In the Linux kernel, the following vulnerability has been resolved: fbdev: broadsheetfb: fix potential memory leak in broadsheetfb probe The memory allocated for pagerefs in fb deferred io init is not freed on the error path. Fix it by calling fb deferred io cleanup...

PT-2026-72462

In the Linux kernel, the following vulnerability has been resolved: fbdev: hecubafb: fix potential memory leak in hecubafb probe The memory allocated for pagerefs in fb deferred io init is not freed on the error path. Fix it by calling fb deferred io cleanup...

PT-2026-72459

In the Linux kernel, the following vulnerability has been resolved: fbdev: i740fb: fix potential memory leak in i740fb probe In i740fb probe, the memory allocated in fb videomode to modelist for modelist is not freed in the error paths. Fix that by calling fb destroy modelist...

PT-2026-72456

In the Linux kernel, the following vulnerability has been resolved: fbdev: tdfxfb: fix potential memory leak in tdfxfb probe In tdfxfb probe, the memory allocated for modelist using fb videomode to modelist when CONFIG FB 3DFX I2C is defined, is not freed in the subsequent error paths. Fix that b...

PT-2026-72612

In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313 rtc probe calls devm request irq with IRQF SHARED and &pdev-dev as the cookie, but platform set drvdata is only called later after the clock setup. With a shared I...

PT-2026-72454

In the Linux kernel, the following vulnerability has been resolved: fbdev: vesafb: fix memory leak in vesafb probe Since commit 73ce73c30ba9 "fbdev: Transfer video= option strings to caller; clarify ownership" the string returned from fb get options is expected to be freed by the caller. But the...

PT-2026-73005

In the Linux kernel, the following vulnerability has been resolved: hwmon: nct6775-core Fix number of temperature registers for NCT6116 Unlike NCT6106, NCT6116 only has three temperature registers, and with it only three temperature source and temperature source configuration registers. The...

UBUNTU-CVE-2026-68371

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Do not put borrowed ofnode in probe omap2430probe stores pdev-dev.ofnode in a local np variable. This is a borrowed pointer and the probe function does not take a reference to it. The success and error paths...

CVE-2026-68371 usb: musb: omap2430: Do not put borrowed of_node in probe

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Do not put borrowed ofnode in probe omap2430probe stores pdev-dev.ofnode in a local np variable. This is a borrowed pointer and the probe function does not take a reference to it. The success and error paths...

CVE-2026-68356

The CVE applies to the Linux kernel watchdog driver for the Airoha clock, where clk_get_rate() can return 0 if the clock is unmanaged or misconfigured. The driver uses wdt_freq as a divisor in airoha_wdt_probe() (to compute max_timeout) and in airoha_wdt_get_timeleft() (to compute remaining time)...