CVE-2026-72362 drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Fix NULL pointer dereference in xeptzapptesentry The page-table walk framework may pass a NULL child pointer for unpopulated entries. xeptzapptesentry called containerofchild before checking for NULL, then dereferenced...

EUVD-2026-59261

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Fix NULL pointer dereference in xeptzapptesentry The page-table walk framework may pass a NULL child pointer for unpopulated entries. xeptzapptesentry called containerofchild before checking for NULL, then dereferenced...

CVE-2026-72362

The CVE-2026-72362 issue affects the Linux kernel DRM/XE PT path (xe_pt_zap_ptes_entry). The vulnerability arises when a NULL child pointer for unpopulated entries is dereferenced because container_of(*child) is called before a NULL check, causing a crash. The fix moves the container_of() call af...

CVE-2026-72358 drm/xe/pt: prevent invalid cursor access for purged BOs

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding, xeptstagebind explicitly skips initializing the xerescursor for purged BOs, treating them similarly to NULL VMAs by only setting the...

CVE-2026-72358 drm/xe/pt: prevent invalid cursor access for purged BOs

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding, xeptstagebind explicitly skips initializing the xerescursor for purged BOs, treating them similarly to NULL VMAs by only setting the...

CVE-2026-72358

CVE-2026-72358 relates to the Linux kernel drm/xe/pt code, where cursor handling for purged BOs could be left uninitialized during page-table walks in xe_pt_hugepte_possible() and xe_pt_scan_64K(), leading to invalid cursor accesses and warnings. The fix adds an explicit purged-BO check (like NUL...

EUVD-2026-59257

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding, xeptstagebind explicitly skips initializing the xerescursor for purged BOs, treating them similarly to NULL VMAs by only setting the...

CVE-2026-72291 KVM: s390: Fix unlikely race in try_get_locked_pte()

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix unlikely race in trygetlockedpte Fix an unlikely race in trygetlockedpte, which could have happened if puds or pmds get unmapped between the p?dpget and p?doffset functions...

CVE-2026-72291

CVE-2026-72291 : In the Linux kernel (KVM for s390), a fix was applied for an unlikely race in try_get_locked_pte() that could occur if puds or pmds are unmapped between p?dp_get() and p?d_offset() calls. The issue affects the page-table handling path and is mitigated by the update; affected comp...

EUVD-2026-59190

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix unlikely race in trygetlockedpte Fix an unlikely race in trygetlockedpte, which could have happened if puds or pmds get unmapped between the p?dpget and p?doffset functions...

EUVD-2026-59138

In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSRAMD64SYSCFGSNPEN" Revert 99cf1fb58e68 "x86/virt/sev: Drop WBINVD before setting MSRAMD64SYSCFGSNPEN". Section 8.8 of the SNP spec says: Before invoking SNPINITEX with INITRMP se...

CVE-2026-72239 x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN"

In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSRAMD64SYSCFGSNPEN" Revert 99cf1fb58e68 "x86/virt/sev: Drop WBINVD before setting MSRAMD64SYSCFGSNPEN". Section 8.8 of the SNP spec says: Before invoking SNPINITEX with INITRMP se...

CVE-2026-72239

The provided documents describe CVE-2026-72239 as a Linux kernel issue in x86/virt/sev related to SNP (Secure Encrypted Virtualization) handling. The root cause is a prior change: dropping WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN, which is reverted. The SNP specification requires flushing di...

CVE-2026-72239 x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN"

In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSRAMD64SYSCFGSNPEN" Revert 99cf1fb58e68 "x86/virt/sev: Drop WBINVD before setting MSRAMD64SYSCFGSNPEN". Section 8.8 of the SNP spec says: Before invoking SNPINITEX with INITRMP se...

CVE-2026-72193

CVE-2026-72193 concerns the in-tree ntfs3 kernel driver. A crafted NTFS3 disk image could trigger an in-kernel infinite loop during mount via a corrupted RESTART_TABLE free-chain, hanging the mounting thread and potentially invoking the soft-lockup watchdog on multi-CPU systems. The vulnerability...

EUVD-2026-58933

In the Linux kernel, the following vulnerability has been resolved: fs/proc/taskmmu: fix makeuffdwphugepte prot-update race Patch series "userfaultfd/pagemap: pre-existing fixes". These are pre-existing bug fixes that were carried at the front of the userfaultfd RWP working-set-tracking series up...

CVE-2026-72174

CVE-2026-72174 affects the Linux kernel’s hugetlb mmap/pagemap handling. The vulnerability arises in fs/proc/task_mmu during a PAGEMAP_SCAN with PM_SCAN_WP_MATCHING on a hugetlb VMA, where walking hole entries via pagemap_scan_pte_hole() leads to a deadlock: the thread holds a read lock while att...

EUVD-2026-59003

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvumboxhandlerlmtsttblsetup uses req-basepcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into th...

CVE-2026-72043 LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix missing dirty page tracking in pte,pmdwrprotect When hardware page table walker PTW is enabled on LoongArch, the CPU may set PAGEDIRTY directly in the page table entry during a write TLB miss, without going through...

CVE-2026-72006 net/mlx5: free mlx5_st_idx_data on final dealloc

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: free mlx5stidxdata on final dealloc Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints e.g. churning RDMA MRs leak one struct mlx5stidxdata per cycle; kmemleak flags it as unreferenced...