CVE-2026-72453

The CVE-2026-72453 issue affects the Linux kernel regcache initialization path. If an error occurs in the cache_ops->populate callback and the cache operations include an exit callback, the error code from populate() is overwritten by the exit() return value, hiding the real error from regcach...

CVE-2026-72451

In the Linux kernel, CVE-2026-72451 concerns the xfrm input state cache insertion path. The vulnerability arises because the code checks state validity before acquiring the global xfrm_state_lock, allowing a race where another party could kill the state after validation and cause a dead state to ...

CVE-2026-72450

The CVE-2026-72450 entry concerns a Linux kernel xfrm (IPsec) weakness where an AF_UNSPEC selector with large prefixlen could cause a shift-out-of-bounds in xfrm_selector_match() when matched against an IPv4 flow with XFRM_STATE_AF_UNSPEC set. The fixes implement: (1) rejecting mismatched familie...

CVE-2026-72449

CVE-2026-72449 : A Linux kernel flaw in drm/amdkfd causing list_del corruption during kfd_criu_resume_svm cleanup, leaving freed objects on the criu_svm_metadata_list. An unprivileged render-group user could trigger a use-after-free/double-free path via /dev/kfd. The fix adds list_del() before kf...

CVE-2026-72447

CVE-2026-72447 (Linux kernel SCTP diag leak) : The vulnerability concerns SCTP_DIAG endpoint dumping in the Linux kernel, where SCTP endpoint address lists were read without holding lock_sock(), allowing concurrent socket operations (e.g., bindx) to change data. This race can cause nla_reserve() ...

CVE-2026-72448

CVE-2026-72448 relates to the Linux kernel driver for octeontx2-pf. The vulnerability is a memory leak in the send-queue (SQ) timestamp buffer: the SQ timestamp ring is allocated with qmem_alloc() when timestamping is used, but otx2_free_sq_res() does not free sq->timestamps, causing memory to...

CVE-2026-72446

CVE-2026-72446 affects the Linux kernel ALSA: usb-audio on Qualcomm, where disable requests could dereference a negative info_idx on the disable path in handle_uaudio_stream_req(), causing memory corruption (read/write) when a stream was never enabled or when the interface doesn’t match. The vuln...

CVE-2026-72445

In the Linux kernel, the ALSA usb-audio: qcom issue CVE-2026-72445 was resolved. On enable, subs->opened was set before validating service_interval; an invalid interval could jump to the error path without clearing it, wedging the substream at -EBUSY until a disable or disconnect. The fix clea...

CVE-2026-72444

CVE-2026-72444 relates to the Linux kernel flow_dissector which could read 12 bytes from eth_hdr(skb) when FLOW_DISSECTOR_KEY_ETH_ADDRS is requested, potentially operating on non-Ethernet or pathologic mac_header states (e.g., TUN in L3 mode). The fix gates the copy to only Ethernet devices (dev-...

CVE-2026-72443

The CVE describes a Linux kernel vulnerability in ALSA usb-audio: MIDI 2.0 URBs could be freed before stopping or draining, risking use-after-free in input_urb_complete when freeing endpoints. Root cause: snd_usb_midi_v2_free() freed endpoint storage and URB buffers without first stopping submitt...

CVE-2026-72441

Mode C: Concrete details found. The CVE item describes a kernel kernel-infoleak in the Linux ieee802154 path (dgram_recvmsg) where pan_id in struct ieee802154_addr is left uninitialized when address mode is IEEE802154_ADDR_NONE. This leads to uninit bytes being copied to user space via sockaddr_i...

CVE-2026-72442

The CVE-2026-72442 entry relates to the Linux kernel netfilter flowtable and IP6IP6 tunnel handling. A fix changes nf_flow_ip6_tunnel_proto() to use pskb_may_pull() instead of skb_header_pointer(), ensuring the outer IPv6 header is in headroom for subsequent processing. The ctx->offset update ...

CVE-2026-72439

The CVE-2026-72439 entry documents a Linux kernel vulnerability in the md/raid10 path where a writes_pending reference is leaked when write requests fail. Root cause: raid10_make_request() grabs writes_pending via md_write_start() and some raid10_write_request() failure paths skip md_write_end(),...

CVE-2026-72440

CVE-2026-72440 affects the Linux kernel md/raid1 code. The issue arises from writes_pending and barrier reference leaks when write failures occur in raid1_write_request(). raid1_make_request() starts a writes_pending reference via md_write_start() and may skip md_write_end() on certain failure pa...

CVE-2026-72438

CVE-2026-72438 affects the Linux kernel md/raid10 subsystem. The issue stems from reference counting leaks in writes_pending and barrier references during discard failures: raid10_make_request() acquires a writes_pending reference via md_write_start() before raid10_handle_discard(), and certain f...

CVE-2026-72436

The CVE-2026-72436 affects the Linux kernel netfilter ipset code. It arises from using test_bit() in lockless RCU readers within hash types, which is a relaxed atomic lacking memory barriers. The fix replaces test_bit() with test_bit_acquire() in code paths that may run parallel with add/del/gc, ...

CVE-2026-72437

CVE-2026-72437 affects the Linux kernel RAID-1 path (md/raid1). When a read is retried and a pre-allocated r1_bio is used, if wait_read_barrier() fails for a REQ_NOWAIT read, the bio is completed but the existing r1_bio may be leaked. The vulnerability is a leak of pre-allocated r1_bio structures...

CVE-2026-72435

The CVE-2026-72435 entry concerns a Linux kernel netfilter/ipset issue where kfree_rcu() was invoked before rcu_assign_pointer() when handling the comment extension. The affected component is the Linux kernel's netfilter/ipset path; the root cause is an incorrect destruction/association order of ...

CVE-2026-72433

CVE-2026-72433 relates to the Linux kernel netfilter nft_meta_bridge path, fixing a stack leak in NFT_META_BRI_IIFPVID. The public descriptions indicate the issue was resolved in the kernel and mentions the need to test for nonzero retval. The available connected documents confirm the vulnerabili...

CVE-2026-72434

CVE-2026-72434 : In the Linux kernel, the netfilter ipset component has a fix to ensure the garbage collector (gc) is properly stopped during set destruction. The issue occurred because cancel_delayed_work_sync() could be called while gc() unconditionally queues work, potentially preventing the g...