CVE-2026-72145

In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/tpmi: use cleanup helpers in memwrite In memwrite, the temporary array returned by parseintarrayuser must be released on all exit paths. Convert the array variable to use cleanup.h scope-based cleanup so it is...

CVE-2026-72143

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Restore SST-PP control to all domains The SST-PP control offset is only restored to power domain 0 after resume. During suspend, control values are read and stored for all power domains. Use pdinfo-sstbase...

CVE-2026-72144

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-laptop: fix missing cleanups in init error path dellinit initializes several resources after dellsetuprfkill, including the optional touchpad LED, keyboard backlight LED, battery hook, debugfs directory and...

CVE-2026-72142

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 atomic SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic polling path rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next receive cycle has...

CVE-2026-72140

In the Linux kernel, the following vulnerability has been resolved: i2c: mlxbf: Fix use-after-free in mlxbfi2cinitresource If devmplatformgetandioremapresource returns an error, mlxbfi2cinitresource frees tmpres before reading tmpres-io to get the error code. This results in a use-after-free. Sav...

CVE-2026-72141

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 IRQ SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next...

CVE-2026-72139

In the Linux kernel, the following vulnerability has been resolved: tcp: defer md5siginfo kfree past RCU grace period in tcpconnect The md5+ao reconciliation in tcpconnect net/ipv4/tcpoutput.c has two symmetric branches: if needsmd5 tcpaodestroysocksk, false; else if needsao tcpclearmd5listsk;...

CVE-2026-72138

In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: fix error handling in ioctl When gntdevioctlmapgrantref fails to copy the operation result back to userspace after successfully adding the mapping to the list, the error path returns -EFAULT without releasing the...

CVE-2026-72136

In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrminterface: require CAPNETADMIN in the device netns for changelink xfrmichangelink operates on at most two netns, devnetdev and the interface link netns xi-net. They differ once the device is created in or moved to a net...

CVE-2026-72137

In the Linux kernel, the following vulnerability has been resolved: xfrm: natkeepalive: avoid double free on send error natkeepalivesend frees the keepalive skb whenever the IPv4 or IPv6 send helper reports an error. That cleanup is only correct before the skb is handed to the output path. Once...

CVE-2026-72135

In the Linux kernel, the following vulnerability has been resolved: tpm: Make the TPM character devices non-seekable The TPM character devices expose a sequential command/response interface, but their open handlers leave FMODEPREAD and FMODEPWRITE enabled. After a command leaves a response pendin...

CVE-2026-72134

In the Linux kernel, the following vulnerability has been resolved: spi: imx: reconfigure for PIO when DMA cannot be started When spiimxcandma selects DMA, the ECSPI is configured for DMA: spiimxsetupxfer sets CTRL.SMC and clears dynamicburst, and spiimxdmatransfer programs the dynamic-burst...

CVE-2026-72133

In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: Fix completion initialization order before devmrequestirq The driver calls devmrequestirq before initializing the completion used by the interrupt handler. Because the interrupt may occur immediately after...

CVE-2026-72132

In the Linux kernel, the following vulnerability has been resolved: NFS: Charge unstable writes by request size, not folio size nfsfoliomarkunstable and nfsfolioclearcommit charge and uncharge NRWRITEBACK/WBWRITEBACK by folionrpagesfolio once per request added to or removed from a commit list. Th...

CVE-2026-72131

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Prevent shared tags across queues on Apple A11 On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag...

CVE-2026-72130

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTHRECEIVE buffers nvmetexecuteauthreceive trusts the AUTHRECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, th...

CVE-2026-72128

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix refcount leak in nvmetsqcreate In nvmetsqcreate, a reference on the ctrl is taken via krefgetunlesszero before calling nvmetchecksqid. If nvmetchecksqid fails, the function returns the error directly without releasing...

CVE-2026-72129

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmetrdmauseinlinesg maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len offset = off;...

CVE-2026-72127

In the Linux kernel, the following vulnerability has been resolved: netdev-genl: report NAPI thread PID in the caller's pid namespace netdevnlnapifillone reports the NAPI kthread PID in NETDEVANAPIPID using taskpidnr, which returns the PID in the initial pid namespace. NETDEVCMDNAPIGET does not...

CVE-2026-72126

In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronizercu in isotprelease isotpnotify unregisters the RCU CAN filters via canrxunregister and clears so-bound without waiting for a grace period. isotprelease uses so-bound to decide whether it...

CVE-2026-72124

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

CVE-2026-72125

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix use-after-free race with concurrent NETDEVUNREGISTER isotprelease looked up the bound network device via devgetbyindex using the stored ifindex. During device unregistration the device is unlisted from the ifindex...

CVE-2026-72123

In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rxop deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 "can: bcm: use callrcu instead of costly synchronizercu" replaced synchronizercu in bcmdeleterxop with callrcu and introduced the RXNOAUTOTIME...

CVE-2026-72122

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix lockless bound/ifindex race and silent RXSETUP failure bcmsendmsg reads bo-ifindex and checks bo-bound before taking locksock, while bcmnotify, bcmconnect and bcmrelease all mutate both fields under that same lock...

CVE-2026-72120

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu list annotations and operations sashiko-bot remarked the missing use of listaddrcu in bcmrx|txsetup to have a proper initialized bcmop structure when bcmprocshow traverses the bcmop's under rcureadlock. ...

CVE-2026-72121

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcmrxsetup when updating timer and filter content while bcmrxhandler, bcmrxtimeouthandler...

CVE-2026-72119

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcmtxlock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there, mirroring the approach already used in bcmrxsetup. Only copy the validat...

CVE-2026-72118

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN detected a data race within the bcmrxhandler when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. Use atomic operations with...

CVE-2026-72116

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device removal RX: an RXSETUP update! for an existing op skipped canrxregister unconditionally, even when a concurrent NETDEVUNREGISTER had already torn down its registration op-rxregdev == NUL...

CVE-2026-72117

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix data race on rxstamp/rxifindex in bcmrxhandler For an rx op subscribed on all interfaces ifindex == 0, the same op is registered once in the shared per-netns wildcard filter list, so bcmrxhandler can run concurrentl...

CVE-2026-72115

In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op ifindex == 0 with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces:...

CVE-2026-72113

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing device refcount for CAN filter removal sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6...

CVE-2026-72114

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP, but bcmrxsetup never did the same for the RTR-reply frame configure...

CVE-2026-72112

In the Linux kernel, the following vulnerability has been resolved: iouring/bpf-ops: reject re-registration of an already-bound ops ioinstallbpf only rejects a second registration on the ctx side ctx-bpfops and sets the per-map back-pointer ops-priv unconditionally. The structops link path never...

CVE-2026-72111

In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register bounds before narrowing retval range in checkmemaccess When the BPF verifier processes a context load of an LSM hook return value, it calls markregs32range to narrow the register to the hook's valid range...

CVE-2026-72109

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: unregister blocking notifier on init failure sparx5registernotifierblocks registers the switchdev blocking notifier before allocating the ordered workqueue. If the workqueue allocation fails, the error path unregiste...

CVE-2026-72110

In the Linux kernel, the following vulnerability has been resolved: bpf,fork: wipe -bpfstorage before bailouts that access it Currently, copyprocess can bail out to freetask before p-bpfstorage has been initialized, with this call graph shown here for the !CONFIGMEMCG case: copyprocess...

CVE-2026-72108

In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consistency on commit failure reservemetadatasnap and releasemetadatasnap modify the superblock's heldroot directly in the blockmanager's buffer. If the subsequent metadata commit fails, th...

CVE-2026-72107

In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but eramap calculates the writeset block before applying the target offset. Tables with a non-zero start sector can...

CVE-2026-72106

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

CVE-2026-72105

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitsetsize overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to regioncount overflow" made sure that regioncount could fit in an unsigned int. But the bitmap memory isn't allocated...

CVE-2026-72104

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject option groups without values The pcache target parses optional arguments as name/value pairs. A table that advertises one optional argument and supplies only a recognized option name, for example "cachemode",...

CVE-2026-72102

In the Linux kernel, the following vulnerability has been resolved: dmearlycreate: fix freeing used table on dmresume failure If dmresume fails, the kernel attempts to free table with dmtabledestroy, but the table was already instantiated with dmswaptable. This commit skips the call to...

CVE-2026-72103

In the Linux kernel, the following vulnerability has been resolved: dm: avoid leaking the caller's thread keyring via the table device file The refactoring in commit a28d893eb327 "md: port block device access to file" accidentally causes the caller's thread keyring to be kept alive long beyond th...

CVE-2026-72101

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix leaking uninitialized kernel memory If hash size is less than device's tuple size, dm-integrity is supposed to zero the remaining space. There was a bug in the code that zeroing didn't work. This commit fixes it...

CVE-2026-72099

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: don't increment hashoffset twice hashoffset is already incremented in the loop "for i = 0; i tocopy; i++, ts--". Do not increment it again...

CVE-2026-72100

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix a bug if the bio is out of limits If dmintegritychecklimits fails, the code would exit with DMMAPIOKILL. However, the range would be already locked at this point, and it wouldn't be unlocked, resulting in a...

CVE-2026-72098

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if neras && neras fec-roots fio-erasuresneras++ = i; This allows neras to reach roots + 1 the post-increment pushes it past roots. This...

CVE-2026-72096

In the Linux kernel, the following vulnerability has been resolved: dm-verity: make error counter atomic The error counter "v-corruptederrs" was not atomic, thus it could be subject to race conditions. The call to dmauditlogtarget"max-corrupted-errors" may be skipped due to the races...

CVE-2026-72097

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix a possible NULL pointer dereference Fix a possible NULL pointer dereference dmverityloadpinisbdevtrusted if the device has no table...