CVE-2026-72337

CVE-2026-72337 : Linux kernel memory safety issue in Bluetooth 6lowpan handling. The flaw stems from lowpan_enable_set() allocating a temporary work item and scheduling do_enable_set() on system_wq, while the debugfs write returns and the worker may run later, potentially operating on stale state...

CVE-2026-72338

Technical details about CVE-2026-72338 are not publicly available in the provided documents. The materials summarize the issue at a high level. Monitor for updated advisories or full exploit specifics from official sources.

CVE-2026-72336

CVE-2026-72336 — Linux kernel, Bluetooth 6lowpan L2CAP hold across debugfs control Root cause: get_l2cap_conn() looks up an LE hci_conn under hdev protection, then drops protection before reading hcon->l2cap_data and before lowpan_control_write() dereferences conn->hcon, allowing a disconne...

CVE-2026-72334

Summary: CVE-2026-72334 affects the Linux kernel Bluetooth ISO handling. The issue arises from malformed ISO_END/ISO_CONT packets not being excluded by the Core spec, which can leak memory and trigger panics. The documented scenarios include: ISO_START with rx_len=4, ISO_CONT skb->len=4, ISO_S...

CVE-2026-72335

CVE-2026-72335 — Linux kernel Bluetooth MGMT fix : The vulnerability is in the MGMT path used by the Bluetooth HCI management code when adding a new adv_monitor. In hci_add_adv_monitor, an adv_monitor is published in hdev->adv_monitors_idr before the powered MSFT offload setup. If the MSFT add...

CVE-2026-72333

CVE-2026-72333 concerns a Linux kernel Bluetooth L2CAP TX identifier leak. The fix was to adjust ident allocation to use an IDA and ensure idents are released when responses arrive, but identifiers allocated for commands without responses (notably LE CREDITS) were not released, allowing exhaustio...

CVE-2026-72331

CVE-2026-72331 affects the Linux kernel. The vulnerability arises in the accel/amdxdna path where, in functions aie2_populate_range() and amdxdna_umap_release() , a saved VMA pointer may have already been freed, leading to a potential use-after-free due to VMA accesses. The issue is resolved by r...

CVE-2026-72332

The CVE-2026-72332 issue affects the Linux kernel’s accel/amdxdna path. The problem arises when amdxdna_hwctx_sync_debug_bo() calls the hardware hwctx_sync_debug_bo() callback while xdna->dev_lock is held. The callback may invoke amdxdna_cmd_submit(), which calls amdxdna_pm_resume_get(); if th...

CVE-2026-72330

The CVE-2026-72330 entry documents a Linux kernel vulnerability in the TLS data path. A peer can send a zero-length TLS application_data record (TLS 1.3 allows these as a traffic-analysis countermeasure). After decryption such a record has full_len == 0 and, in tls_sw_read_sock(), the read loop r...

CVE-2026-72328

In the Linux kernel, CVE-2026-72328 affects the amdxdna subsystem (accel/amdxdna). The issue is a lifetime race in amdxdna_umap_release() where blocking mmu_interval_notifier_remove() occurs before removing the object from abo->mem.umap_list, allowing concurrent aie2_populate_range() to obtain...

CVE-2026-72329

CVE-2026-72329 affects the Linux kernel’s net/liquidio SR-IOV path. The vulnerability arises from the PF SR-IOV enable path caching VF pci_dev pointers in dpiring_to_vfpcidev_lut[] by iterating with pci_get_device(), where entries do not own a reference and the iterator drops the previous device ...

CVE-2026-72327

The CVE-2026-72327 issue affects the Linux kernel DRM v3d indirect CSD setup. v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object from a userspace-supplied handle and may return NULL; this NULL is stored in info->indirect and later dereferenced by the indirect CSD job, turnin...

CVE-2026-72326

CVE-2026-72326 affects the Linux kernel’s net/sched cake scheduler. CAKE accepts signed overhead values stored in an s16, but the adjusted packet length calculation uses unsigned arithmetic, allowing a negative effective length to wrap to a large value. This can cause rate accounting to depend on...

CVE-2026-72325

Technical details of CVE-2026-72325 are not public in the provided documents. Available descriptions summarize the issue but do not expose affected products, versions, or fixes. Monitor for updates from vendors/security advisories.

CVE-2026-72324

Summary: CVE-2026-72324 relates to the Linux kernel GPIO/mvebu domain handling. The issue arises because irq_alloc_domain_generic_chips() allocates generic chip data that must be freed via irq_domain_remove_generic_chips(), but the existing devres action mvebu_gpio_remove_irq_domain() only called...

CVE-2026-72322

CVE-2026-72322 concerns a race in the Linux kernel IPv6 multicast code (MLD delayed work) that can cause a Use-After-Free during device teardown and MLD query processing. The root cause is a use of in6_dev_hold() to take a reference on inet6_dev while it may already be freed (RCU-protected memory...

CVE-2026-72323

CVE-2026-72323 — Linux kernel igmp UAF vulnerability : A race between device teardown (inetdev_destroy) and IGMP query processing (igmp_rcv) can cause a Use-After-Free in the IGMP timer callback when the timer is re-armed. The in_device memory is freed via RCU after its refcount reaches 0, but ig...

CVE-2026-72321

CVE-2026-72321 affects the Linux kernel’s IGMP timer handling (ipv4: igmp). The root cause is a memory leak when deleting or stopping timers in igmp_mod_timer() and igmp_stop_timer(): refcount_dec(&im->refcnt) can drop the group entry im to zero on an RC reader path, leaving the im object leak...

CVE-2026-72319

The CVE-2026-72319 entry describes a Linux kernel vulnerability in IPVS where inner IP headers in ICMP errors must be kept within skb headroom after removing outer headers (pskb_pull). The root cause involves ensuring the inner headers remain present for functions such as ipv4_update_pmtu(), icmp...

CVE-2026-72320

CVE-2026-72320 concerns the Linux kernel netfilter implementation for nft_lookup. The issue arises in how inverted lookups (NFT_LOOKUP_F_INV) interact with the catchall element in interval sets, potentially causing an incorrect verdict. The documented fix folds the catchall lookup into ext before...