CVE-2026-72482 gpib: fix double decrement of descriptor_busy in command_ioctl()

In the Linux kernel, the following vulnerability has been resolved: gpib: fix double decrement of descriptorbusy in commandioctl commit d1857f8296dc "gpib: fix use-after-free in IO ioctl handlers" introduced a descriptorbusy reference counter to pin struct gpibdescriptor across IO ioctl operation...

CVE-2026-72473 xprtrdma: Decouple req recycling from RPC completion

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decouple req recycling from RPC completion rlkref formerly served two distinct lifetimes through a single refcount: it gated when a Reply could wake its RPC task, and it gated when an rpcrdmareq could return to its free...

CVE-2026-72469

CVE-2026-72469 affects the Linux kernel’s xprtrdma/rpcrdma path, where an ADDR_CHANGE event can cause an ep kref underflow because rpcrdma_ep_put() would run without a matching rpcrdma_ep_get() when ESTABLISHED hasn’t occurred yet. The documents describe the lifecycle sequence, showing a mismatch...

CVE-2026-72469 xprtrdma: Fix ep kref imbalance on ADDR_CHANGE

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDRCHANGE rpcrdmacmeventhandler falls through to the disconnected: label on RDMACMEVENTADDRCHANGE and calls rpcrdmaepput with no matching get when the event arrives before RDMACMEVENTESTABLISHE...

CVE-2026-72463 xfrm: Fix dev use-after-free in xfrm async resumption

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb-dev refcnt until after transportfinish. However, xfrmrcvcb may modify skb-dev to tunnel dev without taking device reference, such as vtircvcb. T...

CVE-2026-72463

CVE-2026-72463 (Linux kernel xfrm): The flaw lets a use-after-free occur in xfrm async resumption when xfrm_rcv_cb changes skb->dev to a tunnel device without taking a reference, risking tunnel dev UAF and orig device refcount leaks. The patch stashs the original skb->dev and extends RCU pr...

CVE-2026-72463 xfrm: Fix dev use-after-free in xfrm async resumption

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb-dev refcnt until after transportfinish. However, xfrmrcvcb may modify skb-dev to tunnel dev without taking device reference, such as vtircvcb. T...

EUVD-2026-59355

In the Linux kernel, the following vulnerability has been resolved: apparmor: release exe file resources on path failure getcurrentexepath takes both an exefile reference and a path reference before resolving the path name. If aapathname failed, it returned immediately and leaked both references...

CVE-2026-72456 apparmor: release exe file resources on path failure

In the Linux kernel, the following vulnerability has been resolved: apparmor: release exe file resources on path failure getcurrentexepath takes both an exefile reference and a path reference before resolving the path name. If aapathname failed, it returned immediately and leaked both references...

CVE-2026-72440

CVE-2026-72440 affects the Linux kernel md/raid1 code. The issue arises from writes_pending and barrier reference leaks when write failures occur in raid1_write_request(). raid1_make_request() starts a writes_pending reference via md_write_start() and may skip md_write_end() on certain failure pa...

CVE-2026-72440 md/raid1: fix writes_pending and barrier reference leaks on write failures

In the Linux kernel, the following vulnerability has been resolved: md/raid1: fix writespending and barrier reference leaks on write failures raid1makerequest acquires a writespending reference with mdwritestart before calling raid1writerequest. Several failure paths in raid1writerequest complete...

EUVD-2026-59339

In the Linux kernel, the following vulnerability has been resolved: md/raid1: fix writespending and barrier reference leaks on write failures raid1makerequest acquires a writespending reference with mdwritestart before calling raid1writerequest. Several failure paths in raid1writerequest complete...

CVE-2026-72440 md/raid1: fix writes_pending and barrier reference leaks on write failures

In the Linux kernel, the following vulnerability has been resolved: md/raid1: fix writespending and barrier reference leaks on write failures raid1makerequest acquires a writespending reference with mdwritestart before calling raid1writerequest. Several failure paths in raid1writerequest complete...

EUVD-2026-59338

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writespending leak on write request failures raid10makerequest acquires a writespending reference with mdwritestart before dispatching write requests. Several failure paths in raid10writerequest complete the bio an...

CVE-2026-72439 md/raid10: fix writes_pending leak on write request failures

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writespending leak on write request failures raid10makerequest acquires a writespending reference with mdwritestart before dispatching write requests. Several failure paths in raid10writerequest complete the bio an...

EUVD-2026-59337

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writespending and barrier reference leaks on discard failures raid10makerequest acquires a writespending reference with mdwritestart before calling raid10handlediscard. Several failure paths in raid10handlediscard...

CVE-2026-72438 md/raid10: fix writes_pending and barrier reference leaks on discard failures

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writespending and barrier reference leaks on discard failures raid10makerequest acquires a writespending reference with mdwritestart before calling raid10handlediscard. Several failure paths in raid10handlediscard...

CVE-2026-72438

CVE-2026-72438 affects the Linux kernel md/raid10 subsystem. The issue stems from reference counting leaks in writes_pending and barrier references during discard failures: raid10_make_request() acquires a writes_pending reference via md_write_start() before raid10_handle_discard(), and certain f...

CVE-2026-72386 drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced A group ref is tied to the pending tileroomwork, so we need to release it if the cancel was effective...

CVE-2026-72386

The CVE-2026-72386 affects the Linux kernel, in the DRM Panthor component. It describes a leak that occurs when a group is evicted before the tiler_oom_work is serviced; a group reference is tied to the pending tiler_oom_work and must be released if the cancel is effective. The fix ensures the gr...