CVE-2026-72384 irqchip/ts4800: Fix missing chained handler cleanup on remove

In the Linux kernel, the following vulnerability has been resolved: irqchip/ts4800: Fix missing chained handler cleanup on remove The driver installs a chained handler for the parent interrupt during probe using irqsetchainedhandleranddata, but the remove function does not clear this handler. Thi...

CVE-2026-72384

CVE-2026-72384 affects the Linux kernel irqchip/ts4800 driver. The vulnerability stems from missing cleanup of a chained interrupt handler installed during probe via irq_set_chained_handler_and_data(); the remove path does not clear this handler, creating a dangling callback that may run after th...

CVE-2026-72384

In the Linux kernel, the following vulnerability has been resolved: irqchip/ts4800: Fix missing chained handler cleanup on remove The driver installs a chained handler for the parent interrupt during probe using irqsetchainedhandleranddata, but the remove function does not clear this handler. Thi...

EUVD-2026-59282

In the Linux kernel, the following vulnerability has been resolved: sctp: fix addrwqtimer race in sctpfreeaddrwq sctpfreeaddrwq previously removed addrwqtimer using timerdelete while holding addrwqlock. However, timerdelete does not guarantee that a currently running timer handler has completed...

CVE-2026-72383 sctp: fix addr_wq_timer race in sctp_free_addr_wq()

In the Linux kernel, the following vulnerability has been resolved: sctp: fix addrwqtimer race in sctpfreeaddrwq sctpfreeaddrwq previously removed addrwqtimer using timerdelete while holding addrwqlock. However, timerdelete does not guarantee that a currently running timer handler has completed...

CVE-2026-72383

In the Linux kernel SCTP subsystem, CVE-2026-72383 describes a race in sctp_free_addr_wq() where addr_wq_timer could be re-entered after addr_wq_lock is held, allowing a sctp_addr_wq_timeout_handler() to access freed memory (use-after-free). The vulnerability is mitigated by calling timer_shutdow...

CVE-2026-72382

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

CVE-2026-72383 sctp: fix addr_wq_timer race in sctp_free_addr_wq()

In the Linux kernel, the following vulnerability has been resolved: sctp: fix addrwqtimer race in sctpfreeaddrwq sctpfreeaddrwq previously removed addrwqtimer using timerdelete while holding addrwqlock. However, timerdelete does not guarantee that a currently running timer handler has completed...

CVE-2026-72383

In the Linux kernel, the following vulnerability has been resolved: sctp: fix addrwqtimer race in sctpfreeaddrwq sctpfreeaddrwq previously removed addrwqtimer using timerdelete while holding addrwqlock. However, timerdelete does not guarantee that a currently running timer handler has completed...

CVE-2026-72381

The CVE covers a Linux kernel use-after-free in ksmbd: fp->owner.name (a per-open kstrdup buffer) can be read while freed during a race between two concurrent SMB2 durable reconnects (DH2C/DHnC) on the same persistent_id. The issue stems from a read in ksmbd_vfs_compare_durable_owner() against...

EUVD-2026-59280

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistentid race the fp-owner.name compare-read in ksmbdvfscomparedurableowner against the kfr...

CVE-2026-72381 ksmbd: fix use-after-free of fp->owner.name in durable handle owner check

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistentid race the fp-owner.name compare-read in ksmbdvfscomparedurableowner against the kfr...

CVE-2026-72381

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistentid race the fp-owner.name compare-read in ksmbdvfscomparedurableowner against the kfr...

CVE-2026-72381 ksmbd: fix use-after-free of fp->owner.name in durable handle owner check

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistentid race the fp-owner.name compare-read in ksmbdvfscomparedurableowner against the kfr...

CVE-2026-72380

In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response reqid before indexing rsp pvcallsfronteventhandler takes reqid directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a store, wi...

CVE-2026-72379

In the Linux kernel, the following vulnerability has been resolved: fs: refuse OTMPFILE creation with an unmapped fsuid or fsgid vfstmpfile never checked that the caller's fsuid and fsgid map into the filesystem. On an idmapped mount whose idmapping does not cover the caller's fsu,gid, the -tmpfi...

CVE-2026-72378

In the Linux kernel, the following vulnerability has been resolved: afs: Fix error code in afsextractvladdrs The error codes on these paths are only set on the first iteration through the loop. Set the correct error code on every iteration...

CVE-2026-72376

In the Linux kernel, the following vulnerability has been resolved: afs: Fix misplaced inc of net-cellsoutstanding Fix net-cellsoutstanding being incremented before the check for failure of idralloccyclic, leaving the count incremented on error...

CVE-2026-72374

In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incomi...

CVE-2026-72375

In the Linux kernel, the following vulnerability has been resolved: afs: Fix reinitialisation of the inode, in particular -lockwork It seems that initalising afsvnode::lockwork a single time in the slab's init function isn't sufficient for workstructs. This results in the DEBUGOBJECTS debugging...