CVE-2026-72326

CVE-2026-72326 affects the Linux kernel’s net/sched cake scheduler. CAKE accepts signed overhead values stored in an s16, but the adjusted packet length calculation uses unsigned arithmetic, allowing a negative effective length to wrap to a large value. This can cause rate accounting to depend on...

CVE-2026-72326 net/sched: cake: reject overhead values that underflow length

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...

CVE-2026-72317 SUNRPC: pin upper rpc_clnt across the TLS connect_worker

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpcclnt across the TLS connectworker The TLS connect path has a use-after-free: nothing pins the upper rpcclnt across the delayed connectworker. xsconnect stores task-tkclient in sockxprt::clnt as a raw pointer...

CVE-2026-72317

In the Linux kernel SUNRPC TLS connect path, a use-after-free occurs because upper rpc_clnt is not pinned across the delayed TLS connect_worker. The TLS handshake worker xs_tcp_tls_setup_socket() reads saved fields from a freed rpc_clnt when a handshake fails, leading to a refcount underflow. The...

CVE-2026-72318 cifs: validate DFS referral string offsets

In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets parsedfsreferrals validates that the response header and referral array fit in the received buffer, but each referral also contains string offsets supplied by the server. Those offsets a...

CVE-2026-72225 jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()

In the Linux kernel, the following vulnerability has been resolved: jbd2: fix integer underflow in jbd2journalinitializefastcommit jbd2journalinitializefastcommit validates journal capacity by checking journal-jlast - numfcblks JBD2MINJOURNALBLOCKS. Both jlast and numfcblks are unsigned, so when...

EUVD-2026-59124

In the Linux kernel, the following vulnerability has been resolved: jbd2: fix integer underflow in jbd2journalinitializefastcommit jbd2journalinitializefastcommit validates journal capacity by checking journal-jlast - numfcblks JBD2MINJOURNALBLOCKS. Both jlast and numfcblks are unsigned, so when...

CVE-2026-72225

The CVE-2026-72225 issue is in the Linux kernel’s journal code (jbd2). A numeric underflow occurs in jbd2_journal_initialize_fast_commit() when calculating journal capacity with (journal->j_last - num_fc_blks) where both operands are unsigned; if num_fc_blks > j_last, the subtraction wraps ...

CVE-2026-72225 jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()

In the Linux kernel, the following vulnerability has been resolved: jbd2: fix integer underflow in jbd2journalinitializefastcommit jbd2journalinitializefastcommit validates journal capacity by checking journal-jlast - numfcblks JBD2MINJOURNALBLOCKS. Both jlast and numfcblks are unsigned, so when...

CVE-2026-72213 mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch In allochugetlbfolio, a single hcg pointer is used for both the rsvd and non-rsvd hugetlb cgroup charges. When mapchg is set, hugetlbcgroupchargecgrouprsvd stores the...

EUVD-2026-58971

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch In allochugetlbfolio, a single hcg pointer is used for both the rsvd and non-rsvd hugetlb cgroup charges. When mapchg is set, hugetlbcgroupchargecgrouprsvd stores the...

CVE-2026-72213

CVE-2026-72213 affects the Linux kernel hugetlb code path. The issue arises from using a single h_cg pointer for both rsvd and non-rsvd cgroup charges in alloc_hugetlb_folio(), causing the rsvd pointer to be overwritten and leading to a page_counter underflow during folio cleanup. The fix introdu...

CVE-2026-72213 mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch In allochugetlbfolio, a single hcg pointer is used for both the rsvd and non-rsvd hugetlb cgroup charges. When mapchg is set, hugetlbcgroupchargecgrouprsvd stores the...

EUVD-2026-58953

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attroff in UpdateResidentValue against dataoff In doaction's UpdateResidentValue case fslog.c:3307, lrh-attroff and lrh-redolen come from the on-disk LRH. When they satisfy aoff + dlen res.dataoff, the assignment...

CVE-2026-72195 fs/ntfs3: bound attr_off in UpdateResidentValue against data_off

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attroff in UpdateResidentValue against dataoff In doaction's UpdateResidentValue case fslog.c:3307, lrh-attroff and lrh-redolen come from the on-disk LRH. When they satisfy aoff + dlen res.dataoff, the assignment...

CVE-2026-72195 fs/ntfs3: bound attr_off in UpdateResidentValue against data_off

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attroff in UpdateResidentValue against dataoff In doaction's UpdateResidentValue case fslog.c:3307, lrh-attroff and lrh-redolen come from the on-disk LRH. When they satisfy aoff + dlen res.dataoff, the assignment...

CVE-2026-72191

CVE-2026-72191 (Linux kernel ntfs3): The issue arises in indx_insert_into_buffer where sp and sp_size from hdr_find_split() can cause an underflow when sp_size exceeds remaining buffer, producing an out-of-bounds write and kernel panic. Reports show a crafted NTFS image where interior NTFS_DE siz...

EUVD-2026-58949

In the Linux kernel, the following vulnerability has been resolved: ntfs3: validate split-point offset in indxinsertintobuffer indxinsertintobuffer computes used = used1 - tocopy - spsize; memmovedet, Add2Ptrsp, spsize, used - le32tocpuhdr1-deoff; where sp and spsize come from hdrfindsplit...

CVE-2026-72129 nvmet-rdma: handle inline data with a nonzero offset

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmetrdmauseinlinesg maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len offset = off;...

EUVD-2026-58887

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmetrdmauseinlinesg maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len offset = off;...