381856 matches found
CVE-2026-72423 bpf: Guard conntrack opts error writes
In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an optssz argument. The verifier checks only the memory range described by optssz, but the wrappers...
CVE-2026-72421 ipv4: fib: Don't ignore error route in local/main tables.
In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore error route in local/main tables. When CONFIGIPMULTIPLETABLES is enabled but no rule is added, fiblookup performs route lookup directly on two tables. Since the first lookup does not properly bail out, the...
CVE-2026-72419 netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnat: avoid invalid natnet pointer use on failed nfnatinit We ran into below KASAN splat, which is mostly uninteresting, beside for having nfnatregisterfn in the call chain as a cause for the offending access:...
CVE-2026-72420 md/raid5: avoid R5_Overlap races while breaking stripe batches
In the Linux kernel, the following vulnerability has been resolved: md/raid5: avoid R5Overlap races while breaking stripe batches KCSAN report a race in breakstripebatchlist vs. raid5makerequest on sh-devi.flags plain word write vs. atomic bit op.. and .. one possible scenario is: CPU1 CPU2...
CVE-2026-72418 netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: prevent connlimit drops for early confirmed ct Commit 69894e5b4c5e "netfilter: nftconnlimit: update the count if add was skipped" introduced a regression where packets for valid connections are dropped whe...
CVE-2026-72417 netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: Validate iph-ihl in nfflowip4tunnelproto Add sanity check for iph-ihl field in nfflowip4tunnelproto before using it to compute the header size, avoiding out-of-bounds access with malformed IP headers. While ...
CVE-2026-72415 ASoC: SDCA: Validate written enum value in ge_put_enum_double()
In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Validate written enum value in geputenumdouble geputenumdouble passes the user-supplied enumeration index item0 to sndsocenumitemtoval without checking it against the number of items in the enum: ret =...
CVE-2026-72416 netfilter: nft_compat: ebtables emulation must reject non-bridge targets
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftcompat: ebtables emulation must reject non-bridge targets xtables targets return netfilter verdicts: NFACCEPT, NFDROP, and so on. ebtables targets return incompatible verdicts: EBTACCEPT, EBTDROP, ... We cannot allo...
CVE-2026-72414 net: dsa: sja1105: round up PTP perout pin duration
In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: round up PTP perout pin duration pinduration is converted from the user-provided period to SJA1105 clock ticks and is later passed as the cycletime argument to futurebasetime. Very small period values may becom...
CVE-2026-72413 sctp: fix err_chunk memory leaks in INIT handling
In the Linux kernel, the following vulnerability has been resolved: sctp: fix errchunk memory leaks in INIT handling When sctpverifyinit encounters unrecognized parameters, it allocates an errchunk to report them. However, this chunk is leaked in several code paths: 1. In sctpsfdo51Binit, if...
CVE-2026-72412 s390/mm: Fix handling of _PAGE_UNUSED pte bit
In the Linux kernel, the following vulnerability has been resolved: s390/mm: Fix handling of PAGEUNUSED pte bit The PAGEUNUSED softbit should not really be lying around. Its sole purpose is to signal to trytounmapone and trytomigrateone that the page can be discarded instead of being moved /...
CVE-2026-72411 net: dsa: mxl862xx: fix use-after-free of DSA ports in crc_err_work
In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: fix use-after-free of DSA ports in crcerrwork Upon an MDIO CRC error mxl862xxcrcerrworkfn walks the DSA ports and closes the CPU port conduits: dsaswitchforeachcpuportdp, priv-ds devclosedp-conduit;...
CVE-2026-72409 net: mvneta: re-enable percpu interrupt on resume
In the Linux kernel, the following vulnerability has been resolved: net: mvneta: re-enable percpu interrupt on resume On Marvell MPIC platforms Armada 370/XP/38x, mvneta uses a percpu IRQ disable/enable scheme for NAPI: the ISR mvnetapercpuisr calls disablepercpuirq to mask the MPIC per-CPU...
CVE-2026-72410 octeontx2-af: Validate NIX maximum LFs correctly
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Validate NIX maximum LFs correctly NIX maximum number of LFs can be set via devlink command but that can be done before assigning any LFs to a PF/VF. The condition used to check whether any LFs are assigned is...
CVE-2026-72408 geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
In the Linux kernel, the following vulnerability has been resolved: geneve: gate GRO hint in genevegrocomplete on gs-grohint genevegroreceive reads the GRO hint through geneveskgrohintoff, which honours it only when the socket enabled IFLAGENEVEGROHINT gs-grohint. genevegrocomplete instead calls...
CVE-2026-72407 geneve: validate inner network offset in geneve_gro_complete()
In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in genevegrocomplete Even with both paths gated on gs-grohint, genevegrocomplete re-derives the inner dispatch type and length from the packet and the current gs-grohint, independently of...
CVE-2026-72406 net: sungem: fix probe error cleanup
In the Linux kernel, the following vulnerability has been resolved: net: sungem: fix probe error cleanup geminitone calls gemremoveone when registernetdev fails. gemremoveone unregisters and frees resources owned by the netdevice, including the DMA block, MMIO mapping, PCI regions, and the...
CVE-2026-72405 net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
In the Linux kernel, the following vulnerability has been resolved: net: udptunnel: prevent double queueing in udptunnelnicdevicesync Yue Sun reported a use-after-free and debugobjects warning in udptunnelnicdevicesyncwork during concurrent device operations. The workqueue core clears the interna...
CVE-2026-72404 tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in cleanupbearer due to premature dstcachedestroy TIPC UDP media bearer teardown calls dstcachedestroy on its replicast caches before calling synchronizenet to wait for concurrent RCU readers transmitters to finish:...
CVE-2026-72403 ALSA: FCP: Fix NULL pointer dereference in interface lookup
In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcpfindfcinterface currently selects the first vendor-specific interface...
CVE-2026-72401 bpf: Fix insn_aux_data leak on verifier err_free_env path
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insnauxdata leak on verifier errfreeenv path When bpfcheck allocates env-insnauxdata successfully but later fails to allocate env-succ, it jumps directly to errfreeenv. The existing vfreeenv-insnauxdata sits before the...
CVE-2026-72402 bpf: Mask pseudo pointer values in verifier logs
In the Linux kernel, the following vulnerability has been resolved: bpf: Mask pseudo pointer values in verifier logs printbpfinsn masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPFPSEUDOMAPFD and BPFPSEUDOMAPVALUE...
CVE-2026-72400 seg6: validate SRH length before reading fixed fields
In the Linux kernel, the following vulnerability has been resolved: seg6: validate SRH length before reading fixed fields seg6validatesrh reads fixed SRH fields such as srh-type and srh-hdrlen before checking that the supplied length covers the fixed struct ipv6srhdr fields. The BPF SEG6 encap pa...
CVE-2026-72399 net: enetc: check the number of BDs needed for xdp_frame
In the Linux kernel, the following vulnerability has been resolved: net: enetc: check the number of BDs needed for xdpframe The size of xdpredirectarr array is ENETCMAXSKBFRAGS. However, the number of fragments contained in xdpframe may be greater than or equal to ENETCMAXSKBFRAGS, which will cau...
CVE-2026-72398 sctp: add INIT verification after cookie unpacking
In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried in INIT-ACK. The client then returns this cookie via COOKIE-ECHO, wher...
CVE-2026-72397 hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()
In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/core honor vrmversion in pmbusdata2regvid pmbusdata2regvid hardcoded the VR11 encoding regardless of the vrmversion configured by the driver, while pmbusreg2datavid already switched on it. Any driver that selects a...
CVE-2026-72396 hwmon: adm1275: Prevent reading uninitialized stack
In the Linux kernel, the following vulnerability has been resolved: hwmon: adm1275: Prevent reading uninitialized stack While adding support for the ROHM BD127X0 hot-swap controllers, sashiko reported an error in device-name comparison, which can lead to reading uninitialized stack memory. Quotin...
CVE-2026-72395 hwmon: (pmbus) Fix passing events to regulator core
In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix passing events to regulator core Sashiko reports: Commit 754bd2b4a084 "hwmon: pmbus/core Protect regulator operations with mutex" introduced a worker to batch regulator events over time using atomicor. The delaye...
CVE-2026-72394 hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero
In the Linux kernel, the following vulnerability has been resolved: hwmon: aspeed-g6-pwm-tach Guard fan RPM calculation against divide-by-zero Sashiko reports: In the aspeed-g6-pwm-tacho driver, the aspeedtachvaltorpm function calculates the fan RPM using the tachometer value. However, it does no...
CVE-2026-72393 eth: fbnic: don't cache shinfo across skb realloc
In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: don't cache shinfo across skb realloc fbnictxlso calls skbcowhead which may reallocate the skb including the shared info. We can't use the pointer calculated before the call. BUG: KASAN: slab-use-after-free in...
CVE-2026-72392 ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6: fix NULL deref in fib6walkcontinue on multi-batch dump inet6dumpfib saves its progress in cb-args1 as a positional index within the current hash chain. Between batches, a concurrent fib6newtable can insert a new table...
CVE-2026-72391 net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
In the Linux kernel, the following vulnerability has been resolved: net: phy: sfp: free miibus in sfpi2cmdiobusdestroy sfpi2cmdiobuscreate allocates the I2C MDIO bus with mdioi2calloc, a plain non-devm allocation, and registers it. sfpi2cmdiobusdestroy only unregisters the bus and clears sfp-i2cm...
CVE-2026-72390 net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF
In the Linux kernel, the following vulnerability has been resolved: net/sched: schteql: Introduce slaveslock to avoid race condition and UAF The teql master-slaves singly linked list is not protected against multiple writes. It can be mod'ed concurently from teqlmasterxmit, teqldequeue, teqlinit...
CVE-2026-72389 bridge: stp: Fix a potential use-after-free when deleting a bridge
In the Linux kernel, the following vulnerability has been resolved: bridge: stp: Fix a potential use-after-free when deleting a bridge The three STP timers are not supposed to be armed while the bridge is administratively down. They are synchronously deactivated when the bridge is put...
CVE-2026-72387 drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom()
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix potential invalid pointer deref in groupprocesstileroom If heaps is an ERRPTR, panthorheappoolput will deref an invalid pointer. Make sure we set it to NULL in that case...
CVE-2026-72388 drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock Since dmafence objects can be shared with other subsystems, they may be accessed from hardirq context in those drivers, and we have to take that into...
CVE-2026-72386 drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced A group ref is tied to the pending tileroomwork, so we need to release it if the cancel was effective...
CVE-2026-72385 tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry()
In the Linux kernel, the following vulnerability has been resolved: tracing/fprobe: Fix NULL pointer dereference in fprobefgraphentry fprobefgraphentry sizes a shadow-stack reservation in one walk of the per-ip fprobe list and fills it in a second walk, both under rcureadlock only. A fprobe...
CVE-2026-72384 irqchip/ts4800: Fix missing chained handler cleanup on remove
In the Linux kernel, the following vulnerability has been resolved: irqchip/ts4800: Fix missing chained handler cleanup on remove The driver installs a chained handler for the parent interrupt during probe using irqsetchainedhandleranddata, but the remove function does not clear this handler. Thi...
CVE-2026-72383 sctp: fix addr_wq_timer race in sctp_free_addr_wq()
In the Linux kernel, the following vulnerability has been resolved: sctp: fix addrwqtimer race in sctpfreeaddrwq sctpfreeaddrwq previously removed addrwqtimer using timerdelete while holding addrwqlock. However, timerdelete does not guarantee that a currently running timer handler has completed...
CVE-2026-72382 ksmbd: reject undersized DACLs before parsing ACEs
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...
CVE-2026-72381 ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistentid race the fp-owner.name compare-read in ksmbdvfscomparedurableowner against the kfr...
CVE-2026-72379 fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
In the Linux kernel, the following vulnerability has been resolved: fs: refuse OTMPFILE creation with an unmapped fsuid or fsgid vfstmpfile never checked that the caller's fsuid and fsgid map into the filesystem. On an idmapped mount whose idmapping does not cover the caller's fsu,gid, the -tmpfi...
CVE-2026-72380 xen/pvcalls: bound backend response req_id before indexing rsp[]
In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response reqid before indexing rsp pvcallsfronteventhandler takes reqid directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a store, wi...
CVE-2026-72377 afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints
In the Linux kernel, the following vulnerability has been resolved: afs: Remove setting of ASRELEASEALWAYS for symlinks and mountpoints Regular AFS files correctly use afsfileaops which have releasefolio set as netfsreleasefolio, so ASRELEASEALWAYS is valid for them when fscache is enabled set vi...
CVE-2026-72378 afs: Fix error code in afs_extract_vl_addrs()
In the Linux kernel, the following vulnerability has been resolved: afs: Fix error code in afsextractvladdrs The error codes on these paths are only set on the first iteration through the loop. Set the correct error code on every iteration...
CVE-2026-72376 afs: Fix misplaced inc of net->cells_outstanding
In the Linux kernel, the following vulnerability has been resolved: afs: Fix misplaced inc of net-cellsoutstanding Fix net-cellsoutstanding being incremented before the check for failure of idralloccyclic, leaving the count incremented on error...
CVE-2026-72375 afs: Fix reinitialisation of the inode, in particular ->lock_work
In the Linux kernel, the following vulnerability has been resolved: afs: Fix reinitialisation of the inode, in particular -lockwork It seems that initalising afsvnode::lockwork a single time in the slab's init function isn't sufficient for workstructs. This results in the DEBUGOBJECTS debugging...
CVE-2026-72374 afs: Fix callback service message parsers to pass through -EAGAIN
In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incomi...
CVE-2026-72373 afs: Fix missing NULL pointer check in afs_break_some_callbacks()
In the Linux kernel, the following vulnerability has been resolved: afs: Fix missing NULL pointer check in afsbreaksomecallbacks Fix afsbreaksomecallbacks to check to see if afslookupvolumercu returned NULL e.g. the specified volume is unknown...