CVE-2026-72218

The CVE-2026-72218 entry describes a Linux kernel lockd file refcount leak in nlm_lookup_file() when nlm_do_fopen() fails on a hashed nlm_file. The cached-file path reaches the found: label unconditionally, causing *result and file->f_count to be updated before the error is returned. Wrappers ...

CVE-2026-72218 lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure

In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlmfile refcount leak on cached nlmdofopen failure The cached-file path in nlmlookupfile reaches the found: label unconditionally, even when nlmdofopen fails. At that label result and file-fcount are updated before th...

CVE-2026-72182 power: supply: charger-manager: fix refcount leak in is_full_charged()

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: fix refcount leak in isfullcharged In isfullcharged, powersupplygetbyname is called to obtain a reference to the fuelgauge power supply. If the voltage check uV = desc-fullbattuV succeeds, the...

CVE-2026-72182

The CVE-2026-72182 entry corresponds to a Linux kernel issue in the charger-manager under power: supply where a refcount leak occurs in is_full_charged(). When the voltage check (uV >= fullbatt_uV) is true, a reference obtained via power_supply_get_by_name() is not released, leaking the refcou...

CVE-2026-72182 power: supply: charger-manager: fix refcount leak in is_full_charged()

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: fix refcount leak in isfullcharged In isfullcharged, powersupplygetbyname is called to obtain a reference to the fuelgauge power supply. If the voltage check uV = desc-fullbattuV succeeds, the...

EUVD-2026-58940

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: fix refcount leak in isfullcharged In isfullcharged, powersupplygetbyname is called to obtain a reference to the fuelgauge power supply. If the voltage check uV = desc-fullbattuV succeeds, the...

EUVD-2026-58896

In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: fix error handling in ioctl When gntdevioctlmapgrantref fails to copy the operation result back to userspace after successfully adding the mapping to the list, the error path returns -EFAULT without releasing the...

CVE-2026-72138 xen/gntdev: fix error handling in ioctl

In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: fix error handling in ioctl When gntdevioctlmapgrantref fails to copy the operation result back to userspace after successfully adding the mapping to the list, the error path returns -EFAULT without releasing the...

CVE-2026-72128

CVE-2026-72128 affects the Linux kernel nvmet subsystem. In nvmet_sq_create(), a reference on the ctrl is taken via kref_get_unless_zero() before nvmet_check_sqid(). If nvmet_check_sqid() fails, the function returns an error without releasing the reference, causing a refcount leak. The fix jumps ...

EUVD-2026-58886

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix refcount leak in nvmetsqcreate In nvmetsqcreate, a reference on the ctrl is taken via krefgetunlesszero before calling nvmetchecksqid. If nvmetchecksqid fails, the function returns the error directly without releasing...

CVE-2026-72128 nvmet: fix refcount leak in nvmet_sq_create()

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix refcount leak in nvmetsqcreate In nvmetsqcreate, a reference on the ctrl is taken via krefgetunlesszero before calling nvmetchecksqid. If nvmetchecksqid fails, the function returns the error directly without releasing...

CVE-2026-72128 nvmet: fix refcount leak in nvmet_sq_create()

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix refcount leak in nvmetsqcreate In nvmetsqcreate, a reference on the ctrl is taken via krefgetunlesszero before calling nvmetchecksqid. If nvmetchecksqid fails, the function returns the error directly without releasing...

CVE-2026-72113

Technical details are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

EUVD-2026-59071

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing device refcount for CAN filter removal sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6...

CVE-2026-72113 can: bcm: add missing device refcount for CAN filter removal

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing device refcount for CAN filter removal sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6...

CVE-2026-72113 can: bcm: add missing device refcount for CAN filter removal

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing device refcount for CAN filter removal sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6...

CVE-2026-72085

CVE-2026-72085 concerns the Linux kernel SCSI xen scsiback path. A path in scsiback_get_pend_req() creates a pending command with an uninitialized or not-yet-kref’d se_cmd; if a submission is aborted via a bad grant or unknown ring_req.act, transport_generic_free_cmd() underflows the reference co...

EUVD-2026-59043

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded secmd has only been memset to 0, so its cmdkref is 0; the secmd is...

CVE-2026-72085 scsi: xen: scsiback: Free unsubmitted command instead of double-putting it

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded secmd has only been memset to 0, so its cmdkref is 0; the secmd is...

CVE-2026-72082

The CVE concerns the Linux kernel SCSI elx/efct path. When efct_hw_reqtag_alloc() fails in efct_hw_io_abort(), the error path returns -ENOSPC without releasing the reference obtained via kref_get_unless_zero(), causing a permanent reference leak on the io_to_abort object. Additionally, the abort_...