CVE-2026-72442

The CVE-2026-72442 entry relates to the Linux kernel netfilter flowtable and IP6IP6 tunnel handling. A fix changes nf_flow_ip6_tunnel_proto() to use pskb_may_pull() instead of skb_header_pointer(), ensuring the outer IPv6 header is in headroom for subsequent processing. The ctx->offset update ...

CVE-2026-72439

The CVE-2026-72439 entry documents a Linux kernel vulnerability in the md/raid10 path where a writes_pending reference is leaked when write requests fail. Root cause: raid10_make_request() grabs writes_pending via md_write_start() and some raid10_write_request() failure paths skip md_write_end(),...

CVE-2026-72440

CVE-2026-72440 affects the Linux kernel md/raid1 code. The issue arises from writes_pending and barrier reference leaks when write failures occur in raid1_write_request(). raid1_make_request() starts a writes_pending reference via md_write_start() and may skip md_write_end() on certain failure pa...

CVE-2026-72438

CVE-2026-72438 affects the Linux kernel md/raid10 subsystem. The issue stems from reference counting leaks in writes_pending and barrier references during discard failures: raid10_make_request() acquires a writes_pending reference via md_write_start() before raid10_handle_discard(), and certain f...

CVE-2026-72436

The CVE-2026-72436 affects the Linux kernel netfilter ipset code. It arises from using test_bit() in lockless RCU readers within hash types, which is a relaxed atomic lacking memory barriers. The fix replaces test_bit() with test_bit_acquire() in code paths that may run parallel with add/del/gc, ...

CVE-2026-72437

CVE-2026-72437 affects the Linux kernel RAID-1 path (md/raid1). When a read is retried and a pre-allocated r1_bio is used, if wait_read_barrier() fails for a REQ_NOWAIT read, the bio is completed but the existing r1_bio may be leaked. The vulnerability is a leak of pre-allocated r1_bio structures...

CVE-2026-72435

The CVE-2026-72435 entry concerns a Linux kernel netfilter/ipset issue where kfree_rcu() was invoked before rcu_assign_pointer() when handling the comment extension. The affected component is the Linux kernel's netfilter/ipset path; the root cause is an incorrect destruction/association order of ...

CVE-2026-72433

CVE-2026-72433 relates to the Linux kernel netfilter nft_meta_bridge path, fixing a stack leak in NFT_META_BRI_IIFPVID. The public descriptions indicate the issue was resolved in the kernel and mentions the need to test for nonzero retval. The available connected documents confirm the vulnerabili...

CVE-2026-72434

CVE-2026-72434 : In the Linux kernel, the netfilter ipset component has a fix to ensure the garbage collector (gc) is properly stopped during set destruction. The issue occurred because cancel_delayed_work_sync() could be called while gc() unconditionally queues work, potentially preventing the g...

CVE-2026-72432

Summary: CVE-2026-72432 affects the Linux kernel, specifically the tpm_crb driver. The issue arises when a device could be matched to a platform driver even if its ACPI companion is absent, due to device_match_driver_override(). Root cause: The probe path did not validate ACPI_COMPANION() for NUL...

CVE-2026-72430

The CVE-2026-72430 issue affects the Linux kernel net/sched code (act_ct) where tcf_ct_fill_params() calls nf_connlabels_get() and later paths skip proper cleanup, causing nf_connlabels leaks on two error paths. Each failed RTM_NEWACTION in a network namespace can increment net->ct.labels_used...

CVE-2026-72431

CVE-2026-72431 describes a use-after-free in Linux kernel /proc/allocinfo handling after module unload. The issue arises because allocinfo_start() reinitializes the codetag iterator only at pos=0, but subsequent reads reuse a cached iterator state. allocinfo_stop() releases mod_lock between batch...

CVE-2026-72429

In CVE-2026-72429, the Linux kernel IOAM code had a type confusion with dst_entry embedded in ioam6_lwt. The IPv6 dst cache path could treat this embedded dst_entry as a rt6_info, triggering an invalid cast and potential invalid pointer access via rt6_get_cookie(), especially if rt->sernum is ...

CVE-2026-72428

Summary: This CVE concerns the Linux kernel’s BPF Spectre v4 sanitization logic. The root cause is in check_stack_write_fixed_off(), which computes the byte slot incorrectly (-off - 1) and records writes in slot_type[] using (slot - i) % BPF_REG_SIZE. The sanitization pre-check used slot_type[i],...

CVE-2026-72427

CVE-2026-72427 (Linux kernel) fixes an incorrect indexing of the effective BPF program array when BPF_F_PREORDER is used. The vulnerable path was in replace_effective_prog() (bpf_link_update()) and purge_effective_progs(), which located slots by linearly walking the program hlist. The computed la...

CVE-2026-72426

The CVE-2026-72426 entry describes a Linux kernel vulnerability affecting BPF stack slot cleanup. When cleaning dead stack slots in 4-byte halves, if the high half of a STACK_SPILL is dead and the low half remains live, the low half could be converted to STACK_MISC/STACK_ZERO and its spilled_ptr ...

CVE-2026-72424

CVE-2026-72424 concerns the Linux kernel RTC MSC313 driver. The vulnerability arises when msc313_rtc_probe() calls devm_request_irq() with IRQF_SHARED and the cookie set to &pdev->dev, while platform_set_drvdata() runs later after clock setup. Under a shared IRQ line, another device can fire t...

CVE-2026-72425

In Linux kernel, filtering/redirect (ice) driver had a resource leak in CTRL VSIs when resetting all VFs with FDIR filters enabled. The root cause was CTRL VSIs being invalidated but not freed during ice_reset_all_vfs(); the fix calls ice_vf_ctrl_vsi_release() instead of ice_vf_ctrl_invalidate_vs...

CVE-2026-72423

The CVE-2026-72423 vulnerability affects the Linux kernel’s BPF conntrack error reporting: wrappers for conntrack kfuncs may write to opts->error outside the verifier-checked range, for certain sizes. The issue occurs when using an opts pointer with an accompanying opts__sz argument; the verif...

CVE-2026-72422

Summary: CVE-2026-72422 fixes a use-after-free in ksmbd’s handling of conn->preauth_info during concurrent SMB2 NEGOTIATE on the same Linux kernel connection. The issue arose because the preauth_info state (shared across the negotiate and response paths) could be freed while a concurrent send-...