991877 matches found
CVE-2026-72305 VDUSE: avoid leaking information to userspace
In the Linux kernel, the following vulnerability has been resolved: VDUSE: avoid leaking information to userspace The bounceing is not necessarily page aligned, so current VDUSE can leak kernel information through mapping bounce pages to userspace. Allocate bounce pages with GFPZERO to avoid...
CVE-2026-72304 ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Fix TOCTOU in sofipc4bytesput In sofipc4bytesput, the copy size is derived from the old data-size in the buffer rather than the incoming new data's size field from ucontrol. If the new data has a differen...
CVE-2026-72303 ASoC: SOF: ipc4-control: Validate notification payload size
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Validate notification payload size Validate MODULENOTIFICATION payload length before reading bytes/channel data in control update handling...
CVE-2026-72302 ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Use overflow checks in controlupdate size calc In sofipc3controlupdate, the expectedsize calculation uses firmware-provided cdata-numelems in arithmetic that could overflow on 32-bit platforms, wrapping t...
CVE-2026-72301 ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix TOCTOU in bytesput and bytesget In sofipc3bytesput, the size used for the memcpy is derived from the old data-size already in the buffer, not the incoming new data's size field. If the new data has a...
CVE-2026-72299 tipc: restrict socket queue dumps in enqueue tracepoints
In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tracepoints tipcskenqueue runs with sk-sklock.slock held while the socket is owned by user context. The spinlock protects the backlog queue in this path, but it does not serialize...
CVE-2026-72300 ASoC: SOF: topology: validate vendor array size before parsing
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...
CVE-2026-72298 net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtrendpointpost qrtrendpointpost validates an incoming packet with if !size || len != ALIGNsize, 4 + hdrlen goto err; where size comes from the wire. On 32-bit, sizet is 32 bits and...
CVE-2026-72296 net: ife: require ETH_HLEN to be pullable in ife_decode()
In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETHHLEN to be pullable in ifedecode ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes the decapsulated packet to ethtypetrans, which expects the inner...
CVE-2026-72297 net: atm: reject out-of-range traffic classes in QoS validation
In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation Reject ATM traffic classes above ATMANYCLASS in checktp. SOATMQOS stores the supplied QoS after checkqos succeeds, so accepting larger values leaves invalid...
CVE-2026-72295 LoongArch: KVM: Validate irqchip index in irqfd routing
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate irqchip index in irqfd routing Sashiko reported that the irqchip index is not validated for LoongArch. Add validation and reject out-of-range irqchip indexes to avoid indexing past the routing table's chi...
CVE-2026-72294 LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Check irq validity in kvmvcpuioctlinterrupt Function kvmvcpuioctlinterrupt can be called from userspace, here add irq validility cheking in kvmvcpuioctlinterrupt...
CVE-2026-72293 KVM: s390: vsie: Add missing radix_tree_preload() in _gaccess_shadow_fault()
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: Add missing radixtreepreload in gaccessshadowfault Add missing radixtreepreload in gaccessshadowfault to guarantee forward progress. The core of gaccessshadowfault has been split into gaccessshadowfault in order ...
CVE-2026-72292 KVM: s390: Initialize KVM_S390_GET_CMMA_BITS memory
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Initialize KVMS390GETCMMABITS memory kvms390getcmmabits allocates its output buffer with vmalloc, which does not zero the returned pages: values = vmallocargs-count; In the non-peek migration path, datgetcmma reports a...
CVE-2026-72291 KVM: s390: Fix unlikely race in try_get_locked_pte()
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix unlikely race in trygetlockedpte Fix an unlikely race in trygetlockedpte, which could have happened if puds or pmds get unmapped between the p?dpget and p?doffset functions...
CVE-2026-72290 KVM: s390: pci: Fix GISC refcount leak on AIF enable failure
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix GISC refcount leak on AIF enable failure kvms390giscregister registers the guest ISC before pinning the guest interrupt forwarding pages and allocating the AISB bit. If any of the later setup steps fails, the...
CVE-2026-72289 KVM: arm64: vgic: Check the interrupt is still ours before migrating it
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating it vgicpruneaplist drops both aplistlock and irqlock while migrating an interrupt to another vCPU. After reacquiring the locks it only checks that the affinity ...
CVE-2026-72288 KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling Hyunwoo Kim reports some really bad races should the following situation occur: - LPI-I is pending in vcpu-B's AP list - vcpu-A writes to vcpu-B's ...
CVE-2026-72286 KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs The intra-host migration/mirroring feature is not fully implemented for SEV-SNP VMs. The proper migration requires additional SNP-specific state such as...
CVE-2026-72287 KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks Move the off-by-default consistency check for vmcs12.tprthreshold vs. the virtual APIC vTPR into the "normal" controls checks, as waiting until KVM has...
CVE-2026-72285 KVM: TDX: Reject concurrent change to CPUID entry count
In the Linux kernel, the following vulnerability has been resolved: KVM: TDX: Reject concurrent change to CPUID entry count Reject KVMTDXINITVM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data. tdxtdinit first reads userdata-cpuid.nent to...
CVE-2026-72284 KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs Ignore KVM's internal "service pending PV EOI" request if the vCPU has disabled PV EOIs since the request was made. Asserting that PV EOIs are enabled can fai...
CVE-2026-72282 KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvmiobusgetdev locking responsibilities to callers kvmiobusgetdev returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched device is not the expected type, a...
CVE-2026-72283 KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Nullify irqfd-producer if updating IRTE for bypass fails Nullify irqfd-producer if updating the IRTE for bypass fails, as leaving a dangling pointer will result in a use-after-free if the irqfd is reachable through KVM'...
CVE-2026-72281 KVM: arm64: account pKVM reclaim against the VM mm
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: account pKVM reclaim against the VM mm Protected guest faults charge long term pins to the VM's mm. Teardown can run later from file release, where current-mm may be unrelated. Drop the charge from kvm-mm instead...
CVE-2026-72279 KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backi...
CVE-2026-72280 KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Drop bogus WARN for write to ZCREL2 It is entirely possible for a guest to write to the ZCREL2 sysreg alias while in a nested context, as it is expected if FEATNV2 is advertised to the L1 hypervisor. Get rid of th...
CVE-2026-72278 KVM: arm64: nv: Re-translate VNCR before injecting abort
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLLWRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the gues...
CVE-2026-72277 KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the...
CVE-2026-72276 fbdev: metronomefb: fix potential memory leak in metronomefb_probe()
In the Linux kernel, the following vulnerability has been resolved: fbdev: metronomefb: fix potential memory leak in metronomefbprobe The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. Fix it by calling fbdeferrediocleanup...
CVE-2026-72275 fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()
In the Linux kernel, the following vulnerability has been resolved: fbdev: broadsheetfb: fix potential memory leak in broadsheetfbprobe The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. Fix it by calling fbdeferrediocleanup...
CVE-2026-72274 fbdev: hecubafb: fix potential memory leak in hecubafb_probe()
In the Linux kernel, the following vulnerability has been resolved: fbdev: hecubafb: fix potential memory leak in hecubafbprobe The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. Fix it by calling fbdeferrediocleanup...
CVE-2026-72273 fbdev: efifb: fix memory leak in efifb_probe()
In the Linux kernel, the following vulnerability has been resolved: fbdev: efifb: fix memory leak in efifbprobe Since commit 73ce73c30ba9 "fbdev: Transfer video= option strings to caller; clarify ownership" the string returned from fbgetoptions is expected to be freed by the caller, but the strin...
CVE-2026-72272 fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
In the Linux kernel, the following vulnerability has been resolved: fbdev: radeon: fix potential memory leak in radeonfbpciregister The function radeonfbpciregister allocates memory for modelist by calling radeoncheckmodes which calls fbaddvideomode. The memory is appended to info-modelist, but i...
CVE-2026-72271 fbdev: i740fb: fix potential memory leak in i740fb_probe()
In the Linux kernel, the following vulnerability has been resolved: fbdev: i740fb: fix potential memory leak in i740fbprobe In i740fbprobe, the memory allocated in fbvideomodetomodelist for modelist is not freed in the error paths. Fix that by calling fbdestroymodelist...
CVE-2026-72270 fbdev: s3fb: fix potential memory leak in s3_pci_probe()
In the Linux kernel, the following vulnerability has been resolved: fbdev: s3fb: fix potential memory leak in s3pciprobe In s3pciprobe, the memory allocated for modelist using fbvideomodetomodelist is not freed in subsequent error paths. Fix that by calling fbdestroymodelist...
CVE-2026-72268 fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
In the Linux kernel, the following vulnerability has been resolved: fbdev: tdfxfb: fix potential memory leak in tdfxfbprobe In tdfxfbprobe, the memory allocated for modelist using fbvideomodetomodelist when CONFIGFB3DFXI2C is defined, is not freed in the subsequent error paths. Fix that by callin...
CVE-2026-72269 fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: fix potential memory leak in uvesafbprobe Due to an incorrect goto label, memory allocated for modedb and modelist in uvesafbvbeinit is not freed in some error paths. Fix this by updating the goto label...
CVE-2026-72266 fbdev: vesafb: fix memory leak in vesafb_probe()
In the Linux kernel, the following vulnerability has been resolved: fbdev: vesafb: fix memory leak in vesafbprobe Since commit 73ce73c30ba9 "fbdev: Transfer video= option strings to caller; clarify ownership" the string returned from fbgetoptions is expected to be freed by the caller. But the...
CVE-2026-72267 fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
In the Linux kernel, the following vulnerability has been resolved: fbdev: carminefb: fix potential memory leak in alloccarminefb The memory allocated for modelist in fbvideomodetomodelist is not freed in the subsequent error path. Fix that by calling fbdestroymodelist...
CVE-2026-72265 fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
In the Linux kernel, the following vulnerability has been resolved: fbdev: nvidia: fix potential memory leak in nvidiafbprobe In nvidiafbprobe, the memory allocated for modelist in nvidiasetfbinfo is not freed in the subsequent error paths. Fix that by calling fbdestroymodelist...
CVE-2026-72264 fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
In the Linux kernel, the following vulnerability has been resolved: fbdev: tridentfb: fix potential memory leak in tridentpciprobe In tridentpciprobe, the memory allocated for modelist using fbvideomodetomodelist is not freed in subsequent error paths. Fix that by calling fbdestroymodelist...
CVE-2026-72263 ASoC: SOF: topology: fix memory leak in snd_sof_load_topology
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: fix memory leak in sndsofloadtopology When the topology filename contains "dummy" and tplgcnt is 0, the function returns -EINVAL directly without freeing the tplgfiles allocated by kcalloc at line 2497. This...
CVE-2026-72261 ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in sndsofupdatecontrol In sndsofupdatecontrol, firmware-provided cdata-numelems is checked against localcdata-data-size but never against the actual allocation size. If localcdata-data-size...
CVE-2026-72262 ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...
CVE-2026-72260 ASoC: mediatek: mt8192: Check runtime resume during probe
In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Check runtime resume during probe The MT8192 AFE probe enables runtime PM temporarily while reinitializing the regmap cache from hardware, but it uses pmruntimegetsync without checking the return value. If...
CVE-2026-72259 ASoC: mediatek: mt8192: Release reserved memory on cleanup
In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Release reserved memory on cleanup The MT8192 AFE probe calls ofreservedmemdeviceinit and falls back to preallocated buffers when no reserved memory region is available. When the reserved memory assignment...
CVE-2026-72258 ASoC: mediatek: mt8183: Release reserved memory on cleanup
In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8183: Release reserved memory on cleanup The MT8183 AFE probe can assign reserved memory with ofreservedmemdeviceinit, but the assignment is never released on driver removal or later probe failures. Register a...
CVE-2026-72257 ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback
In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm: fix NULL pointer dereference in graphcallback When q6apmfreefragments is called it frees rxdata.buf/txdata.buf and sets them to NULL under graph-lock. A late DSP buffer-done response can race with this:...
CVE-2026-72256 netfilter: xt_cluster: reject template conntracks in hash match
In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This causes a state confusion bug when the raw table C...