CVE-2026-72380 xen/pvcalls: bound backend response req_id before indexing rsp[]

In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response reqid before indexing rsp pvcallsfronteventhandler takes reqid directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a store, wi...

EUVD-2026-59279

In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response reqid before indexing rsp pvcallsfronteventhandler takes reqid directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a store, wi...

CVE-2026-72366

The CVE-2026-72366 issue affects the Linux kernel netfs path: netfs_create_write_req() could skip caching if the fscache cookie was disabled, potentially delaying async cache object creation and causing fscache_begin_write_operation() to be skipped. The fix removes cookie-based checks and delegat...

CVE-2026-72366 netfs: Fix netfs_create_write_req() to handle async cache object creation

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfscreatewritereq to handle async cache object creation netfscreatewritereq will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough...

EUVD-2026-59265

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfscreatewritereq to handle async cache object creation netfscreatewritereq will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough...

CVE-2026-72365 netfs: Fix writethrough to use collection offload

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix writethrough to use collection offload Fix writethrough write to set NETFSRREQOFFLOADCOLLECTION on the request so that collection is processed asynchronously rather than only right at the end - and also so that...

EUVD-2026-59264

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix writethrough to use collection offload Fix writethrough write to set NETFSRREQOFFLOADCOLLECTION on the request so that collection is processed asynchronously rather than only right at the end - and also so that...

CVE-2026-72338

CVE-2026-72338 affects the Linux kernel net/sched code, specifically the act_pedit offload path. A TOCTOU race in the flower classifier between sizing a flow_rule buffer and filling it allows a heap OOB write to adjacent memory (KASAN: slab-out-of-bounds in tcf_pedit_offload_act_setup). The flaw ...

EUVD-2026-59237

In the Linux kernel, the following vulnerability has been resolved: net/sched: actpedit: fix TOCTOU heap OOB write in tc offload There is a TOCTOU race condition in flower lockless approach between sizing a flowrule buffer and filling it. [email protected] reports: The clsflower...

CVE-2026-72338 net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload

In the Linux kernel, the following vulnerability has been resolved: net/sched: actpedit: fix TOCTOU heap OOB write in tc offload There is a TOCTOU race condition in flower lockless approach between sizing a flowrule buffer and filling it. [email protected] reports: The clsflower...

CVE-2026-72298

In the provided documents, CVE-2026-72298 is described as a Linux kernel vulnerability in the QRTR net path. The issue arises in qrtr_endpoint_post() where the size field from the wire is not rejected before an ALIGN(size, 4) operation, causing a 32-bit overflow when size >= 0xfffffffd. This a...

EUVD-2026-59179

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Drop bogus WARN for write to ZCREL2 It is entirely possible for a guest to write to the ZCREL2 sysreg alias while in a nested context, as it is expected if FEATNV2 is advertised to the L1 hypervisor. Get rid of th...

CVE-2026-72278 KVM: arm64: nv: Re-translate VNCR before injecting abort

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLLWRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the gues...

EUVD-2026-59177

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLLWRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the gues...

CVE-2026-72261

In the Linux kernel ASoC SOF component, the ipc3-control path in snd_sof_update_control lacks a bounds check: firmware-provided cdata->num_elems is checked against local_cdata->data->size but not against the actual allocation size. If the local size was previously inconsistent, memcpy co...

EUVD-2026-59151

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nftpipapomatch can enter a bad state: - some fields can have their lookup tables resized while others did not - bits...

CVE-2026-72252

The CVE-2026-72252 entry describes a Linux kernel memory-allocation fault in netfilter nft_set_pipapo. On allocation failure, the cloned nft_pipapo_match can enter a bad state where some lookup-table fields resize while others do not, bits may toggle, and the scratch map can be undersized, causin...

CVE-2026-72252 netfilter: nft_set_pipapo: don't leak bad clone into future transaction

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nftpipapomatch can enter a bad state: - some fields can have their lookup tables resized while others did not - bits...

CVE-2026-72237

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/brs: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERFSAMPLEBRANCHUSER is requested. On AM...

EUVD-2026-58975

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdrbuftobvec stores before writing xdrbuftobvec writes a biovec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When the...