CVE-2026-72500 RDMA/bnxt_re: Free SRQ toggle page after firmware teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free SRQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroysrq won't write the toggle values to an already-freed...

CVE-2026-72498 RDMA/bnxt_re: Avoid displaying the kernel pointer

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Avoid displaying the kernel pointer While dumping the info on MR using the rdma tool, we dump the mrhwq which is a kernel pointer. There is no need to expose this value for end user. So avoid it...

CVE-2026-72499 RDMA/bnxt_re: Free CQ toggle page after firmware teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroycq won't write the toggle value to an already-freed page...

CVE-2026-72497 RDMA/bnxt_re: Add a max slot check for SQ

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Add a max slot check for SQ The variable WQE mode must be validated against the maximum slots supported by HW. The max supported value is 64K. Adding a max and min check and fail if user supplied value is more than t...

CVE-2026-72496 RDMA/bnxt_re: Proper rollback if the ioremap fails

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Proper rollback if the ioremap fails bnxtqpliballocdpi returns success even if ioremap fails. Add the proper rollback when the ioremap fails and return -ENOMEM status...

CVE-2026-72495 RDMA/bnxt_re: Avoid repeated requests to allocate WC pages

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Avoid repeated requests to allocate WC pages Applications can request multiple WC pages for the same ucontext. As of now, only 1 WC page per ucontext is supported. Add a lock to avoid concurrent access and a check to...

CVE-2026-72494 RDMA/irdma: Replace waitqueue and flag with completion

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Replace waitqueue and flag with completion The driver previously used a waitqueue along with an explicit requestdone flag, but without proper barriers around requestdone. An earlier patch by Gui-Dong Han attempted to...

CVE-2026-72493 net: serialize netif_running() check in enqueue_to_backlog()

In the Linux kernel, the following vulnerability has been resolved: net: serialize netifrunning check in enqueuetobacklog Syzbot reported a KASAN slab-use-after-free in fibruleslookup. The root cause is a race condition where packets can escape the backlog flushing during device unregistration...

CVE-2026-72491 net/9p: fix race condition on rdma->state in trans_rdma.c

In the Linux kernel, the following vulnerability has been resolved: net/9p: fix race condition on rdma-state in transrdma.c The rdma-state field is modified without holding reqlock in both recvdone and p9cmeventhandler, while rdmarequest accesses the same field under the reqlock spinlock. This...

CVE-2026-72492 ksmbd: fix use-after-free in same_client_has_lease()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in sameclienthaslease sameclienthaslease returns an opinfo pointer from ci-moplist after dropping ci-mlock without taking a reference. smbgrantoplock then dereferences that pointer in copylease and when...

CVE-2026-72490 staging: rtl8723bs: fix stainfo check in rtw_aes_decrypt

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtwaesdecrypt The null-pointer-guard was incorrect, returning FAIL on valid pointer. Invert the guard, so it returns FAIL on invalid pointer...

CVE-2026-72489 staging: nvec: fix use-after-free in nvec_rx_completed()

In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvecrxcompleted In nvecrxcompleted, when an incomplete RX transfer is detected, nvecmsgfree is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately aft...

CVE-2026-72488 soundwire: fix bug in sdw_add_element_group_count found by syzkaller

In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdwaddelementgroupcount found by syzkaller The original implementation caused an out-of-bounds memory access in the sdwaddelementgroupcount for-loop when i == num. for i = 0; i ratesi && lane == group-lanesi...

CVE-2026-72487 PCI: Check ROM header and data structure addr before accessing

In the Linux kernel, the following vulnerability has been resolved: PCI: Check ROM header and data structure addr before accessing We meet a crash when running stress-ng on x8664 machine: BUG: unable to handle page fault for address: ffa0000007f40000 RIP: 0010:pcigetromsize+0x52/0x220 Call Trace:...

CVE-2026-72486 mailbox: mtk-adsp: fix UAF during device teardown

In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...

CVE-2026-72485 coresight: platform: defer connection counter increment until alloc succeeds

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...

CVE-2026-72484 staging: most: video: avoid double free on video register failure

In the Linux kernel, the following vulnerability has been resolved: staging: most: video: avoid double free on video register failure compregistervideodev allocates a videodevice with videodevicealloc and releases it if videoregisterdevice fails. This can double free the videodevice when...

CVE-2026-72483 usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()

In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421: Fix shift-out-of-bounds in max3421hubcontrol The max3421hubcontrol function handles USB hub class requests to the virtual root hub. In the default branches of both the ClearPortFeature and SetPortFeature switc...

CVE-2026-72482 gpib: fix double decrement of descriptor_busy in command_ioctl()

In the Linux kernel, the following vulnerability has been resolved: gpib: fix double decrement of descriptorbusy in commandioctl commit d1857f8296dc "gpib: fix use-after-free in IO ioctl handlers" introduced a descriptorbusy reference counter to pin struct gpibdescriptor across IO ioctl operation...

CVE-2026-72481 iio: magnetometer: ak8975: fix potential kernel stack memory leak

In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: ak8975: fix potential kernel stack memory leak Currently in the AK8975 driver there are four instances where potential uninitialized kernel stack memory leaks can occur. If i2csmbusreadi2cblockdataoremulated...