CVE-2026-72453

In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cacheops-populate callback, and if cache operations include an exit callback, the error code from...

CVE-2026-72452 drm/i915: clear CRTC color blob pointers after dropping refs

In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intelcrtcputcolorblobs drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intelcrtcprepareclearedstate, which fre...

CVE-2026-72452 drm/i915: clear CRTC color blob pointers after dropping refs

In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intelcrtcputcolorblobs drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intelcrtcprepareclearedstate, which fre...

EUVD-2026-59351

In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intelcrtcputcolorblobs drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intelcrtcprepareclearedstate, which fre...

CVE-2026-72451

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrmstatelock. Thus it's possible for someone else to kill the state after it passed...

CVE-2026-72451

In the Linux kernel, CVE-2026-72451 concerns the xfrm input state cache insertion path. The vulnerability arises because the code checks state validity before acquiring the global xfrm_state_lock, allowing a race where another party could kill the state after validation and cause a dead state to ...

CVE-2026-72449 drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadata without removing it from the list. The list head is left pointing a...

CVE-2026-72449

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadata without removing it from the list. The list head is left pointing a...

CVE-2026-72449

CVE-2026-72449 : A Linux kernel flaw in drm/amdkfd causing list_del corruption during kfd_criu_resume_svm cleanup, leaving freed objects on the criu_svm_metadata_list. An unprivileged render-group user could trigger a use-after-free/double-free path via /dev/kfd. The fix adds list_del() before kf...

EUVD-2026-59348

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadata without removing it from the list. The list head is left pointing a...

CVE-2026-72449 drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadata without removing it from the list. The list head is left pointing a...

CVE-2026-72448

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown The send-queue timestamp ring is allocated with qmemalloc when timestamping is used, but otx2freesqres never freed sq-timestamps, leaking that memory across ifdown and...

CVE-2026-72447

In the Linux kernel, the following vulnerability has been resolved: sctp: hold socket lock when dumping endpoints in sctpdiag SCTPDIAG endpoint dumping was traversing endpoint address lists without holding locksock, while those lists could change concurrently via socket operations e.g., bindx...

CVE-2026-72446

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: reject stream disable with no active interface handleuaudiostreamreq resolves an interface index with infoidxfromifnum, which returns -EINVAL when no interface matches. The enable branch and the response:...

CVE-2026-72445

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: clear opened when stream enable fails On enable, subs-opened is set before the serviceinterval is validated; an invalid interval jumps to the response label without clearing it, so the substream is wedged a...

CVE-2026-72444

In the Linux kernel, the following vulnerability has been resolved: flowdissector: check device type before reading ETHADDRS skbflowdissect unconditionally reads 12 bytes from ethhdrskb when FLOWDISSECTORKEYETHADDRS is requested. This assumes the skb has a valid Ethernet header at macheader, whic...

EUVD-2026-59342

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during sndusbmidiv2create. A later setup failure can still jump to sndusbmidiv2free, which currently frees each endpoint and its coheren...

CVE-2026-72443 ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during sndusbmidiv2create. A later setup failure can still jump to sndusbmidiv2free, which currently frees each endpoint and its coheren...

CVE-2026-72443 ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during sndusbmidiv2create. A later setup failure can still jump to sndusbmidiv2free, which currently frees each endpoint and its coheren...

CVE-2026-72443

The CVE describes a Linux kernel vulnerability in ALSA usb-audio: MIDI 2.0 URBs could be freed before stopping or draining, risking use-after-free in input_urb_complete when freeing endpoints. Root cause: snd_usb_midi_v2_free() freed endpoint storage and URB buffers without first stopping submitt...