CVE-2026-72382

CVE-2026-72382 affects the Linux kernel ksmbd component. The issue is an unsigned underflow in parse_dacl() when computing the ACE count for a security descriptor, caused by subtracting sizeof(struct smb_acl) from a 16-bit DACL size. This can allow a malformed security descriptor to bypass the AC...

CVE-2026-72382 ksmbd: reject undersized DACLs before parsing ACEs

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

CVE-2026-72382 ksmbd: reject undersized DACLs before parsing ACEs

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

CVE-2026-72367

Technical details about CVE-2026-72367 are not publicly provided in the supplied documents; monitor for updates.

EUVD-2026-59266

In the Linux kernel, the following vulnerability has been resolved: iomap: guard iosize EOF trim against concurrent truncate underflow iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that iosize tracks only valid data within EOF. This trims iosize when a...

CVE-2026-72367 iomap: guard io_size EOF trim against concurrent truncate underflow

In the Linux kernel, the following vulnerability has been resolved: iomap: guard iosize EOF trim against concurrent truncate underflow iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that iosize tracks only valid data within EOF. This trims iosize when a...

CVE-2026-72367 iomap: guard io_size EOF trim against concurrent truncate underflow

In the Linux kernel, the following vulnerability has been resolved: iomap: guard iosize EOF trim against concurrent truncate underflow iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that iosize tracks only valid data within EOF. This trims iosize when a...

CVE-2026-72326

CVE-2026-72326 affects the Linux kernel’s net/sched cake scheduler. CAKE accepts signed overhead values stored in an s16, but the adjusted packet length calculation uses unsigned arithmetic, allowing a negative effective length to wrap to a large value. This can cause rate accounting to depend on...

CVE-2026-72326 net/sched: cake: reject overhead values that underflow length

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...

CVE-2026-72317 SUNRPC: pin upper rpc_clnt across the TLS connect_worker

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpcclnt across the TLS connectworker The TLS connect path has a use-after-free: nothing pins the upper rpcclnt across the delayed connectworker. xsconnect stores task-tkclient in sockxprt::clnt as a raw pointer...

CVE-2026-72317

In the Linux kernel SUNRPC TLS connect path, a use-after-free occurs because upper rpc_clnt is not pinned across the delayed TLS connect_worker. The TLS handshake worker xs_tcp_tls_setup_socket() reads saved fields from a freed rpc_clnt when a handshake fails, leading to a refcount underflow. The...

CVE-2026-72318 cifs: validate DFS referral string offsets

In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets parsedfsreferrals validates that the response header and referral array fit in the received buffer, but each referral also contains string offsets supplied by the server. Those offsets a...

CVE-2026-72225 jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()

In the Linux kernel, the following vulnerability has been resolved: jbd2: fix integer underflow in jbd2journalinitializefastcommit jbd2journalinitializefastcommit validates journal capacity by checking journal-jlast - numfcblks JBD2MINJOURNALBLOCKS. Both jlast and numfcblks are unsigned, so when...

CVE-2026-72225 jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()

In the Linux kernel, the following vulnerability has been resolved: jbd2: fix integer underflow in jbd2journalinitializefastcommit jbd2journalinitializefastcommit validates journal capacity by checking journal-jlast - numfcblks JBD2MINJOURNALBLOCKS. Both jlast and numfcblks are unsigned, so when...

EUVD-2026-59124

In the Linux kernel, the following vulnerability has been resolved: jbd2: fix integer underflow in jbd2journalinitializefastcommit jbd2journalinitializefastcommit validates journal capacity by checking journal-jlast - numfcblks JBD2MINJOURNALBLOCKS. Both jlast and numfcblks are unsigned, so when...

CVE-2026-72225

The CVE-2026-72225 issue is in the Linux kernel’s journal code (jbd2). A numeric underflow occurs in jbd2_journal_initialize_fast_commit() when calculating journal capacity with (journal->j_last - num_fc_blks) where both operands are unsigned; if num_fc_blks > j_last, the subtraction wraps ...

EUVD-2026-58971

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch In allochugetlbfolio, a single hcg pointer is used for both the rsvd and non-rsvd hugetlb cgroup charges. When mapchg is set, hugetlbcgroupchargecgrouprsvd stores the...

CVE-2026-72213

CVE-2026-72213 affects the Linux kernel hugetlb code path. The issue arises from using a single h_cg pointer for both rsvd and non-rsvd cgroup charges in alloc_hugetlb_folio(), causing the rsvd pointer to be overwritten and leading to a page_counter underflow during folio cleanup. The fix introdu...

CVE-2026-72213 mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch In allochugetlbfolio, a single hcg pointer is used for both the rsvd and non-rsvd hugetlb cgroup charges. When mapchg is set, hugetlbcgroupchargecgrouprsvd stores the...

CVE-2026-72213 mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch In allochugetlbfolio, a single hcg pointer is used for both the rsvd and non-rsvd hugetlb cgroup charges. When mapchg is set, hugetlbcgroupchargecgrouprsvd stores the...