CVE-2026-72043

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix missing dirty page tracking in pte,pmdwrprotect When hardware page table walker PTW is enabled on LoongArch, the CPU may set PAGEDIRTY directly in the page table entry during a write TLB miss, without going through...

CVE-2026-72018

In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in movedata The loopback movedata performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory...

CVE-2026-68478

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

CVE-2026-74439

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry devicepasidtableteardown zeroes the 128-bit scalable-mode context entry with contextclearentry while the Present bit is still set. This creates a windo...

CVE-2026-74439 iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry devicepasidtableteardown zeroes the 128-bit scalable-mode context entry with contextclearentry while the Present bit is still set. This creates a windo...

EUVD-2026-59537

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix out-of-bounds write in irdmacopyuserpgaddrs The irdmacopyuserpgaddrs function loops through all of the umem DMA blocks to populate the PBLEs and will stop when either the last DMA block is reached or palloc-totalc...

CVE-2026-74390 RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix out-of-bounds write in irdmacopyuserpgaddrs The irdmacopyuserpgaddrs function loops through all of the umem DMA blocks to populate the PBLEs and will stop when either the last DMA block is reached or palloc-totalc...

CVE-2026-74390

The CVE-2026-74390 entry concerns the Linux kernel RDMA/irdma path. A bug in irdma_copy_user_pgaddrs could cause an out-of-bounds write to iwmr->pgaddrmem when irdma_setup_pbles runs with lvl==0 and palloc->total_cnt==0, because the loop may continue past the fixed 4-entry pgaddrmem array i...

CVE-2026-74371 bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat

In the Linux kernel, the following vulnerability has been resolved: bpf: fix BPFPROGQUERY OOB write and cgroup backward compat BPFPROGQUERY writes back the 'query.revision' field unconditionally to userspace. If userspace passes a smaller 'bpfattr' structure e.g. 40 bytes, which was the layout...

CVE-2026-74371 bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat

In the Linux kernel, the following vulnerability has been resolved: bpf: fix BPFPROGQUERY OOB write and cgroup backward compat BPFPROGQUERY writes back the 'query.revision' field unconditionally to userspace. If userspace passes a smaller 'bpfattr' structure e.g. 40 bytes, which was the layout...

CVE-2026-74371

The CVE concerns the Linux kernel BPF_PROG_QUERY OOB write. BPF_PROG_QUERY unconditionally writes query.revision to userspace; if a smaller bpf_attr buffer is provided, this can cause an out-of-bounds write. The fixes propagate the user-supplied attribute size (uattr_size) down to the cgroup quer...

EUVD-2026-59518

In the Linux kernel, the following vulnerability has been resolved: bpf: fix BPFPROGQUERY OOB write and cgroup backward compat BPFPROGQUERY writes back the 'query.revision' field unconditionally to userspace. If userspace passes a smaller 'bpfattr' structure e.g. 40 bytes, which was the layout...

EUVD-2026-59509

In the Linux kernel, the following vulnerability has been resolved: ext2: fix ignored return value of genericwritesync Fix ext2diowriteiter to propagate the error returned by genericwritesync instead of silently discarding it, which could cause write2 to return success to userspace on OSYNC/ODSYN...

CVE-2026-74362

In the Linux kernel CVE-2026-74362, the vulnerability stems from ext2_write paths where ext2_dio_write_iter() does not propagate the error returned by generic_write_sync(), potentially causing write(2) to report success for O_SYNC/O_DSYNC files even when the sync failed. The corrective pattern is...

CVE-2026-74362 ext2: fix ignored return value of generic_write_sync()

In the Linux kernel, the following vulnerability has been resolved: ext2: fix ignored return value of genericwritesync Fix ext2diowriteiter to propagate the error returned by genericwritesync instead of silently discarding it, which could cause write2 to return success to userspace on OSYNC/ODSYN...

EUVD-2026-59455

In the Linux kernel, the following vulnerability has been resolved: ext4: fix kernel BUG in ext4writeinlinedataend When the data=journal mount option is used, the ext4journalledwriteend function incorrectly calls ext4writeinlinedataend without checking if the EXT4STATEMAYINLINEDATA flag is still...

CVE-2026-74308 ext4: fix kernel BUG in ext4_write_inline_data_end

In the Linux kernel, the following vulnerability has been resolved: ext4: fix kernel BUG in ext4writeinlinedataend When the data=journal mount option is used, the ext4journalledwriteend function incorrectly calls ext4writeinlinedataend without checking if the EXT4STATEMAYINLINEDATA flag is still...

CVE-2026-72495 RDMA/bnxt_re: Avoid repeated requests to allocate WC pages

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Avoid repeated requests to allocate WC pages Applications can request multiple WC pages for the same ucontext. As of now, only 1 WC page per ucontext is supported. Add a lock to avoid concurrent access and a check to...

CVE-2026-72470

Summary: CVE-2026-72470 affects the Linux kernel ntfs3 driver. When mounting a dirty NTFS volume, log_replay() initially allocates log->one_page_buf using the host’s PAGE_SIZE, but if the on-disk page size is larger, the buffer is not grown. This can lead to reading log data into an undersized...

CVE-2026-72457

In the Linux kernel, the following vulnerability has been resolved: apparmor: fail policy unpack on accept2 allocation failure unpackpdb may need to allocate a missing ACCEPT2 table for older policy data. If that allocation failed, it set an error message but jumped to the success path, returning...