CVE-2026-72255 netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: pin bridge device while NFQUEUE holds fake dst The brnetfilter fake rtable is embedded in struct netbridge and is attached to bridged packets with skbdstsetnoref. If such a packet is queued to NFQUEUE, nfqueue...

CVE-2026-72254 netfilter: nft_fib: reject fib expression on the netdev egress hook

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftfib: reject fib expression on the netdev egress hook A fib expression in a netdev egress base chain dereferences nftinpkt, NULL on the transmit path, causing a NULL pointer dereference at eval. nftfibvalidate masks...

CVE-2026-72253 netfilter: nf_conntrack_sip: validate skb_dst() before accessing it

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: validate skbdst before accessing it tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relies o...

EUVD-2026-59151

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nftpipapomatch can enter a bad state: - some fields can have their lookup tables resized while others did not - bits...

CVE-2026-72252 netfilter: nft_set_pipapo: don't leak bad clone into future transaction

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nftpipapomatch can enter a bad state: - some fields can have their lookup tables resized while others did not - bits...

CVE-2026-72252

CVE-2026-72252 affects the Linux kernel netfilter nft_set_pipapo mechanism. On memory allocation failure, the cloned nft_pipapo_match can enter a bad state where lookup tables may be resized inconsistently, bits toggled, and the scratch map undersized, enabling a subsequent insertion in the same ...

CVE-2026-72252 netfilter: nft_set_pipapo: don't leak bad clone into future transaction

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nftpipapomatch can enter a bad state: - some fields can have their lookup tables resized while others did not - bits...

CVE-2026-72252

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nftpipapomatch can enter a bad state: - some fields can have their lookup tables resized while others did not - bits...

CVE-2026-72251 netfilter: nf_nat_sip: reload possible stale data pointer

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnatsip: reload possible stale data pointer quoting sashiko: ------------------------------------------------------------------------ .. noticed a potential memory bug and header corruption involving the SIP NAT helpe...

CVE-2026-72250 netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag nfctfrag6reasm slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb-macheader: skb-macheader += sizeofstru...

CVE-2026-72249 netfilter: flowtable: use dst in this direction when pushing IPIP header

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use dst in this direction when pushing IPIP header When pushing the IPIP header, the route of the other direction is used to calculate the headroom, use the route in this direction. Accessing the other tuple...

CVE-2026-72248 netfilter: flowtable: support IPIP tunnel with direct xmit

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dstentry is provided to check the skb headroom and to set the iph-fragoff field. Thi...

CVE-2026-72247 netfilter: nf_conncount: fix zone comparison in tuple dedup

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: fix zone comparison in tuple dedup The "already exists" dedup logic in nfconncountadd decides whether a connection has already been counted and can be skipped instead of incrementing the connlimit count. I...

CVE-2026-72246 netfilter: flowtable: use correct direction to set up tunnel route

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use correct direction to set up tunnel route The layer 2 encapsulation and layer 3 tunnel information in the xmit path is taken from the other tuple, because the tunnel information that is included in the...

CVE-2026-72245 gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix device reference leak in host1xdeviceparsedt error path After deviceinitialize, the embedded struct device in struct host1xdevice should be released through the device core with putdevice. In host1xdeviceadd, if...

CVE-2026-72243 selinux: check connect-related permissions on TCP Fast Open

In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are checked when using TCP Fast Open. Update...

CVE-2026-72244 gpu/buddy: bail out of try_harder when alignment cannot be honoured

In the Linux kernel, the following vulnerability has been resolved: gpu/buddy: bail out of tryharder when alignment cannot be honoured The tryharder contiguous fallback could return a range whose start offset did not match the caller's minblocksize. When a candidate's start is misaligned, realign...

CVE-2026-72242 selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()

In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sksocket dereference in selinuxsctpbindconnect selinuxsctpbindconnect dereferences sk-sksocket to pass a struct socket to selinuxsocketbind and selinuxsocketconnecthelper. However, when the hook is invoked from the...

CVE-2026-72241 leds: uleds: Fix potential buffer overread

In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr on it might result in a buffer overread. The same thing will happen when said string is use...

CVE-2026-72240 mfd: sm501: Fix reference leak on failed device registration

In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix reference leak on failed device registration When platformdeviceregister fails in sm501registerdevice, the embedded struct device in pdev has already been initialized by deviceinitialize, but the failure path only...