CVE-2026-72049

In the Linux kernel, the following vulnerability has been resolved: ieee802154: admin-gate legacy LLSEC dump operations In net/ieee802154/netlink.c, the legacy IEEE802154NL family ops table builds the LLSEC dump entries LLSECLISTKEY, LLSECLISTDEV, LLSECLISTDEVKEY, LLSECLISTSECLEVEL with...

CVE-2026-72091

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...

CVE-2026-72282

In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvmiobusgetdev locking responsibilities to callers kvmiobusgetdev returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched device is not the expected type, a...

CVE-2026-72284

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs Ignore KVM's internal "service pending PV EOI" request if the vCPU has disabled PV EOIs since the request was made. Asserting that PV EOIs are enabled can fai...

CVE-2026-72209

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate attribute values on lookup ntfsattrfind and ntfsexternalattrfind check that generic resident attribute values fit in their attribute records and that fixed-size resident values are large enough. For variable-length...

CVE-2026-72221

In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When waitforcompletioninterruptibletimeout in svctcphandshake returns 0 timeout or -ERESTARTSYS signal and tlshandshakecancel then returns false,...

CVE-2026-72205

In the Linux kernel, the following vulnerability has been resolved: ntfs: free volume-wide resources on fillsuper failure ntfsfillsuper's erroutnow path frees only the volume struct via kfreevol, leaving several vol-owned allocations behind on every mount failure: - vol-nlsmap, loaded by...

CVE-2026-72130

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTHRECEIVE buffers nvmetexecuteauthreceive trusts the AUTHRECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, th...

CVE-2026-72121

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcmrxsetup when updating timer and filter content while bcmrxhandler, bcmrxtimeouthandler...

CVE-2026-72239

In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSRAMD64SYSCFGSNPEN" Revert 99cf1fb58e68 "x86/virt/sev: Drop WBINVD before setting MSRAMD64SYSCFGSNPEN". Section 8.8 of the SNP spec says: Before invoking SNPINITEX with INITRMP se...

CVE-2026-72210

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one in mapping pairs decoding bounds checks In ntfsmappingpairsdecompress, attrend points one byte past the end of the attribute record: attrend = u8 attr + le32tocpuattr-length; The two bounds checks validating...

CVE-2026-72016

In the Linux kernel, the following vulnerability has been resolved: cpu/hotplug: Fix NULL kobject warning in cpuhpsmtenable On arm64, when booting with maxcpus greater than the number of present CPUs e.g., QEMU -smp cpus=4,maxcpus=8, some CPUs are marked as 'present' but have not yet been...

CVE-2026-72154

In the Linux kernel, the following vulnerability has been resolved: openrisc: Fix jumplabel smp syncing The original commit 8c30b0018f9d "openrisc: Add jump label support" copies from arm64 and does not properly consider how icache invalidation on remote cores works in OpenRISC. On OpenRISC remot...

CVE-2026-72128

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix refcount leak in nvmetsqcreate In nvmetsqcreate, a reference on the ctrl is taken via krefgetunlesszero before calling nvmetchecksqid. If nvmetchecksqid fails, the function returns the error directly without releasing...

CVE-2026-72017

In the Linux kernel, the following vulnerability has been resolved: net: macb: drop in-flight Tx SKBs on close The MACB driver has since forever leaked the outgoing SKBs that have not yet been marked as completed. They live in queue-txskb which gets freed without remorse nor checking...

CVE-2026-72136

In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrminterface: require CAPNETADMIN in the device netns for changelink xfrmichangelink operates on at most two netns, devnetdev and the interface link netns xi-net. They differ once the device is created in or moved to a net...

CVE-2026-72097

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix a possible NULL pointer dereference Fix a possible NULL pointer dereference dmverityloadpinisbdevtrusted if the device has no table...

CVE-2026-72259

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Release reserved memory on cleanup The MT8192 AFE probe calls ofreservedmemdeviceinit and falls back to preallocated buffers when no reserved memory region is available. When the reserved memory assignment...

CVE-2026-72178

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: always put unsuccessfully committed target pids damoncommittarget puts and gets the destination and the source target pids. It puts the destination target pid because it will be overwritten by the source target pid...

CVE-2026-72031

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD The PNY CS900 1TB SSD Phison PS3111-S11, DRAM-less drops off the bus after entering Device-Initiated Slumber during idle. With the default medpowerwithdipm policy the link...

CVE-2026-72125

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix use-after-free race with concurrent NETDEVUNREGISTER isotprelease looked up the bound network device via devgetbyindex using the stored ifindex. During device unregistration the device is unlisted from the ifindex...

CVE-2026-72075

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix race condition in resetdevice sysfs callback The imspcuresetdevice sysfs callback calls imspcuexecutecommand without acquiring pcu-cmdmutex. This can lead to data races and corruption of the shared command...

CVE-2026-72088

In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path If physdisk-inreset is set, the function returns directly without undoing the resources acquired for the command. Add the missing error cleanup by unmapping the IOACCEL2 SG...

CVE-2026-72103

In the Linux kernel, the following vulnerability has been resolved: dm: avoid leaking the caller's thread keyring via the table device file The refactoring in commit a28d893eb327 "md: port block device access to file" accidentally causes the caller's thread keyring to be kept alive long beyond th...

CVE-2026-72145

In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/tpmi: use cleanup helpers in memwrite In memwrite, the temporary array returned by parseintarrayuser must be released on all exit paths. Convert the array variable to use cleanup.h scope-based cleanup so it is...

CVE-2026-72054

In the Linux kernel, the following vulnerability has been resolved: net: ipvti: require CAPNETADMIN in the device netns for changelink vtichangelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than t...

CVE-2026-72090

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

CVE-2026-72108

In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consistency on commit failure reservemetadatasnap and releasemetadatasnap modify the superblock's heldroot directly in the blockmanager's buffer. If the subsequent metadata commit fails, th...

CVE-2026-72276

In the Linux kernel, the following vulnerability has been resolved: fbdev: metronomefb: fix potential memory leak in metronomefbprobe The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. Fix it by calling fbdeferrediocleanup...

CVE-2026-72189

In the Linux kernel, the following vulnerability has been resolved: ntfs: fail attrlist updates when the superblock is inactive genericshutdownsuper clears SBACTIVE before evicting cached inodes. If eviction selects the fake inode for a base inode's unnamed $ATTRIBUTELIST attribute,...

CVE-2026-72176

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: put stats for schemeadddirs internal error damonsysfsschemeadddirs setup the triedregions directory after the stats directory setup is completed. When the triedregions directory setup is failed, the setup...

CVE-2026-72079

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix use-after-free and double-free in disconnect imspcudisconnect only intended to perform cleanup when the primary control interface is unbound. However, it currently relies on the interface class to distinguish...

CVE-2026-72071

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Fix use-after-free in usereventmmdup usereventmmdup walks the parent mm's enabler list locklessly under rcureadlock during fork from copyprocess; it does not take eventmutex: rcureadlock;...

CVE-2026-72173

In the Linux kernel, the following vulnerability has been resolved: fs/proc/taskmmu: do not warn on seeing non-migration pmd entry Patch series "mm/hmm: A fix and a selftest", v3. Patch 1 fixes a stale warning present from the time when only migration softleaf entries were supported at the PMD...

CVE-2026-72225

In the Linux kernel, the following vulnerability has been resolved: jbd2: fix integer underflow in jbd2journalinitializefastcommit jbd2journalinitializefastcommit validates journal capacity by checking journal-jlast - numfcblks JBD2MINJOURNALBLOCKS. Both jlast and numfcblks are unsigned, so when...

CVE-2026-72074

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix type confusion in CDC union descriptor parsing The driver currently trusts the bMasterInterface0 from the CDC union descriptor without verifying that it matches the interface being probed. This could lead to...

CVE-2026-72059

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure t7xxcldmalateinit creates mdctrl-gpddmapool before initializing the TX and RX rings. If any ring initialization fails, the error path frees the already initialized ring...

CVE-2026-72165

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix condition in 'nandselecttarget' 'cs' here must be in range 0:nanddevntargets...

CVE-2026-72143

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Restore SST-PP control to all domains The SST-PP control offset is only restored to power domain 0 after resume. During suspend, control values are read and stored for all power domains. Use pdinfo-sstbase...

CVE-2026-72094

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-fence: Fix potential NULL pointer dereference The commit mentioned in the fixes tag below introduced a mechanism through which fence producers can fully decouple from fence consumers. This, desirable, mechanism is...

CVE-2026-72162

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2sumrightmostrec BUG On-disk corruption setting lnextfreerec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. CAUSE...

CVE-2026-72133

In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: Fix completion initialization order before devmrequestirq The driver calls devmrequestirq before initializing the completion used by the interrupt handler. Because the interrupt may occur immediately after...

CVE-2026-72058

In the Linux kernel, the following vulnerability has been resolved: net: ixp4xxhss: fix duplicate HDLC netdev allocation ixp4xxhssprobe allocates two HDLC netdevs. The first one is stored in ndev, initialized, and registered with registerhdlcdevice. The second one is stored in port-netdev and lat...

CVE-2026-72262

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

CVE-2026-72117

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix data race on rxstamp/rxifindex in bcmrxhandler For an rx op subscribed on all interfaces ifindex == 0, the same op is registered once in the shared per-netns wildcard filter list, so bcmrxhandler can run concurrentl...

CVE-2026-72147

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma-pcie: Reject devices without driver data dwedmapcieprobe treats the PCI device ID driverdata as the template for the controller layout and copies it unconditionally. A device bound dynamically via sysfs can mat...

CVE-2026-72199

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident index root values on lookup Resident $INDEXROOT values carry index header fields that callers consume after lookup. Some callers already validate parts of the layout before walking entries, but those check...

CVE-2026-72146

In the Linux kernel, the following vulnerability has been resolved: dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Once the interrupt is requested, the interrupt handler may run immediately. Since the IRQ handler can access channel-chbase, which is initialized only afte...

CVE-2026-72018

In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in movedata The loopback movedata performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory...

CVE-2026-72095

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Make dmafencededuparray robust against 0-count input dmafencededuparray returns 1 when called with numfences == 0: the for-loop body never executes, j stays at 0, and the final return ++j yields 1. This contradicts bot...