CVE-2026-72142 i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 atomic SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic polling path rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next receive cycle has...

CVE-2026-72140 i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()

In the Linux kernel, the following vulnerability has been resolved: i2c: mlxbf: Fix use-after-free in mlxbfi2cinitresource If devmplatformgetandioremapresource returns an error, mlxbfi2cinitresource frees tmpres before reading tmpres-io to get the error code. This results in a use-after-free. Sav...

CVE-2026-72141 i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ)

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 IRQ SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next...

CVE-2026-72139 tcp: defer md5sig_info kfree past RCU grace period in tcp_connect

In the Linux kernel, the following vulnerability has been resolved: tcp: defer md5siginfo kfree past RCU grace period in tcpconnect The md5+ao reconciliation in tcpconnect net/ipv4/tcpoutput.c has two symmetric branches: if needsmd5 tcpaodestroysocksk, false; else if needsao tcpclearmd5listsk;...

CVE-2026-72138 xen/gntdev: fix error handling in ioctl

In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: fix error handling in ioctl When gntdevioctlmapgrantref fails to copy the operation result back to userspace after successfully adding the mapping to the list, the error path returns -EFAULT without releasing the...

CVE-2026-72137 xfrm: nat_keepalive: avoid double free on send error

In the Linux kernel, the following vulnerability has been resolved: xfrm: natkeepalive: avoid double free on send error natkeepalivesend frees the keepalive skb whenever the IPv4 or IPv6 send helper reports an error. That cleanup is only correct before the skb is handed to the output path. Once...

CVE-2026-72136 xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink

In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrminterface: require CAPNETADMIN in the device netns for changelink xfrmichangelink operates on at most two netns, devnetdev and the interface link netns xi-net. They differ once the device is created in or moved to a net...

CVE-2026-72135 tpm: Make the TPM character devices non-seekable

In the Linux kernel, the following vulnerability has been resolved: tpm: Make the TPM character devices non-seekable The TPM character devices expose a sequential command/response interface, but their open handlers leave FMODEPREAD and FMODEPWRITE enabled. After a command leaves a response pendin...

CVE-2026-72134 spi: imx: reconfigure for PIO when DMA cannot be started

In the Linux kernel, the following vulnerability has been resolved: spi: imx: reconfigure for PIO when DMA cannot be started When spiimxcandma selects DMA, the ECSPI is configured for DMA: spiimxsetupxfer sets CTRL.SMC and clears dynamicburst, and spiimxdmatransfer programs the dynamic-burst...

CVE-2026-72132 NFS: Charge unstable writes by request size, not folio size

In the Linux kernel, the following vulnerability has been resolved: NFS: Charge unstable writes by request size, not folio size nfsfoliomarkunstable and nfsfolioclearcommit charge and uncharge NRWRITEBACK/WBWRITEBACK by folionrpagesfolio once per request added to or removed from a commit list. Th...

CVE-2026-72133 spi: uniphier: Fix completion initialization order before devm_request_irq()

In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: Fix completion initialization order before devmrequestirq The driver calls devmrequestirq before initializing the completion used by the interrupt handler. Because the interrupt may occur immediately after...

CVE-2026-72131 nvme-apple: Prevent shared tags across queues on Apple A11

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Prevent shared tags across queues on Apple A11 On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag...

CVE-2026-72130 nvmet-auth: reject short AUTH_RECEIVE buffers

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTHRECEIVE buffers nvmetexecuteauthreceive trusts the AUTHRECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, th...

CVE-2026-72129 nvmet-rdma: handle inline data with a nonzero offset

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmetrdmauseinlinesg maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len offset = off;...

CVE-2026-72128 nvmet: fix refcount leak in nvmet_sq_create()

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix refcount leak in nvmetsqcreate In nvmetsqcreate, a reference on the ctrl is taken via krefgetunlesszero before calling nvmetchecksqid. If nvmetchecksqid fails, the function returns the error directly without releasing...

CVE-2026-72127 netdev-genl: report NAPI thread PID in the caller's pid namespace

In the Linux kernel, the following vulnerability has been resolved: netdev-genl: report NAPI thread PID in the caller's pid namespace netdevnlnapifillone reports the NAPI kthread PID in NETDEVANAPIPID using taskpidnr, which returns the PID in the initial pid namespace. NETDEVCMDNAPIGET does not...

CVE-2026-72126 can: isotp: use unconditional synchronize_rcu() in isotp_release()

In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronizercu in isotprelease isotpnotify unregisters the RCU CAN filters via canrxunregister and clears so-bound without waiting for a grace period. isotprelease uses so-bound to decide whether it...

CVE-2026-72124 can: isotp: serialize TX state transitions under so->rx_lock

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

CVE-2026-72125 can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix use-after-free race with concurrent NETDEVUNREGISTER isotprelease looked up the bound network device via devgetbyindex using the stored ifindex. During device unregistration the device is unlisted from the ifindex...

CVE-2026-72123 can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF

In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rxop deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 "can: bcm: use callrcu instead of costly synchronizercu" replaced synchronizercu in bcmdeleterxop with callrcu and introduced the RXNOAUTOTIME...