CVE-2026-72331

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix VMA access race aie2populaterange and amdxdnaumaprelease access a saved VMA pointer that may have already been freed, leading to a potential use-after-free. Remove the VMA accesses from these functions to avoid...

CVE-2026-72331 accel/amdxdna: Fix VMA access race

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix VMA access race aie2populaterange and amdxdnaumaprelease access a saved VMA pointer that may have already been freed, leading to a potential use-after-free. Remove the VMA accesses from these functions to avoid...

CVE-2026-72330

In the Linux kernel, the following vulnerability has been resolved: net/tls: Consume empty data records in tlsswreadsock A peer may send a zero-length TLS applicationdata record; TLS 1.3 explicitly permits these as a traffic-analysis countermeasure RFC 8446, Section 5.1. After decryption such a...

EUVD-2026-59227

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdnaumap lifetime race amdxdnaumaprelease calls the blocking mmuintervalnotifierremove before removing the object from abo-mem.umaplist. If aie2populaterange runs concurrently, it may obtain a...

CVE-2026-72329 net/liquidio: drop cached VF pci_dev LUT

In the Linux kernel, the following vulnerability has been resolved: net/liquidio: drop cached VF pcidev LUT The PF SR-IOV enable path caches VF pcidev pointers in dpiringtovfpcidevlut by iterating with pcigetdevice. Those entries do not own a reference, because the iterator drops the previous...

CVE-2026-72328

In the Linux kernel, CVE-2026-72328 affects the amdxdna subsystem (accel/amdxdna). The issue is a lifetime race in amdxdna_umap_release() where blocking mmu_interval_notifier_remove() occurs before removing the object from abo->mem.umap_list, allowing concurrent aie2_populate_range() to obtain...

CVE-2026-72328 accel/amdxdna: Fix potential amdxdna_umap lifetime race

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdnaumap lifetime race amdxdnaumaprelease calls the blocking mmuintervalnotifierremove before removing the object from abo-mem.umaplist. If aie2populaterange runs concurrently, it may obtain a...

CVE-2026-72328 accel/amdxdna: Fix potential amdxdna_umap lifetime race

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdnaumap lifetime race amdxdnaumaprelease calls the blocking mmuintervalnotifierremove before removing the object from abo-mem.umaplist. If aie2populaterange runs concurrently, it may obtain a...

CVE-2026-72328

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdnaumap lifetime race amdxdnaumaprelease calls the blocking mmuintervalnotifierremove before removing the object from abo-mem.umaplist. If aie2populaterange runs concurrently, it may obtain a...

CVE-2026-72329

CVE-2026-72329 affects the Linux kernel’s net/liquidio SR-IOV path. The vulnerability arises from the PF SR-IOV enable path caching VF pci_dev pointers in dpiring_to_vfpcidev_lut[] by iterating with pci_get_device(), where entries do not own a reference and the iterator drops the previous device ...

CVE-2026-72329 net/liquidio: drop cached VF pci_dev LUT

In the Linux kernel, the following vulnerability has been resolved: net/liquidio: drop cached VF pcidev LUT The PF SR-IOV enable path caches VF pcidev pointers in dpiringtovfpcidevlut by iterating with pcigetdevice. Those entries do not own a reference, because the iterator drops the previous...

EUVD-2026-59228

In the Linux kernel, the following vulnerability has been resolved: net/liquidio: drop cached VF pcidev LUT The PF SR-IOV enable path caches VF pcidev pointers in dpiringtovfpcidevlut by iterating with pcigetdevice. Those entries do not own a reference, because the iterator drops the previous...

CVE-2026-72327

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3dgetcpuindirectcsdparams looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes...

CVE-2026-72325

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path Branch Sampling BRS and Last Branch Record LBR are mutually exclusive hardware features, and users of both are tracked via cpuc-lbrusers. When SVM is toggled on a CPU...

EUVD-2026-59222

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmpgqstarttimer A race condition exists between device teardown inetdevdestroy and incoming IGMP query processing igmprcv, leading to a Use-After-Free in the IGMP timer callback. During device...

CVE-2026-72322

CVE-2026-72322 concerns a race in the Linux kernel IPv6 multicast code (MLD delayed work) that can cause a Use-After-Free during device teardown and MLD query processing. The root cause is a use of in6_dev_hold() to take a reference on inet6_dev while it may already be freed (RCU-protected memory...

EUVD-2026-59221

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary...

CVE-2026-72322

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary...

CVE-2026-72322 ipv6: mcast: Fix potential UAF in MLD delayed work

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary...

CVE-2026-72323 ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmpgqstarttimer A race condition exists between device teardown inetdevdestroy and incoming IGMP query processing igmprcv, leading to a Use-After-Free in the IGMP timer callback. During device...