CVE-2026-72437

CVE-2026-72437 affects the Linux kernel RAID-1 path (md/raid1). When a read is retried and a pre-allocated r1_bio is used, if wait_read_barrier() fails for a REQ_NOWAIT read, the bio is completed but the existing r1_bio may be leaked. The vulnerability is a leak of pre-allocated r1_bio structures...

CVE-2026-72435

The CVE-2026-72435 entry concerns a Linux kernel netfilter/ipset issue where kfree_rcu() was invoked before rcu_assign_pointer() when handling the comment extension. The affected component is the Linux kernel's netfilter/ipset path; the root cause is an incorrect destruction/association order of ...

CVE-2026-72433

CVE-2026-72433 relates to the Linux kernel netfilter nft_meta_bridge path, fixing a stack leak in NFT_META_BRI_IIFPVID. The public descriptions indicate the issue was resolved in the kernel and mentions the need to test for nonzero retval. The available connected documents confirm the vulnerabili...

CVE-2026-72434

CVE-2026-72434 : In the Linux kernel, the netfilter ipset component has a fix to ensure the garbage collector (gc) is properly stopped during set destruction. The issue occurred because cancel_delayed_work_sync() could be called while gc() unconditionally queues work, potentially preventing the g...

CVE-2026-72432

Summary: CVE-2026-72432 affects the Linux kernel, specifically the tpm_crb driver. The issue arises when a device could be matched to a platform driver even if its ACPI companion is absent, due to device_match_driver_override(). Root cause: The probe path did not validate ACPI_COMPANION() for NUL...

CVE-2026-72430

The CVE-2026-72430 issue affects the Linux kernel net/sched code (act_ct) where tcf_ct_fill_params() calls nf_connlabels_get() and later paths skip proper cleanup, causing nf_connlabels leaks on two error paths. Each failed RTM_NEWACTION in a network namespace can increment net->ct.labels_used...

CVE-2026-72431

CVE-2026-72431 describes a use-after-free in Linux kernel /proc/allocinfo handling after module unload. The issue arises because allocinfo_start() reinitializes the codetag iterator only at pos=0, but subsequent reads reuse a cached iterator state. allocinfo_stop() releases mod_lock between batch...

CVE-2026-72429

In CVE-2026-72429, the Linux kernel IOAM code had a type confusion with dst_entry embedded in ioam6_lwt. The IPv6 dst cache path could treat this embedded dst_entry as a rt6_info, triggering an invalid cast and potential invalid pointer access via rt6_get_cookie(), especially if rt->sernum is ...

CVE-2026-72428

Summary: This CVE concerns the Linux kernel’s BPF Spectre v4 sanitization logic. The root cause is in check_stack_write_fixed_off(), which computes the byte slot incorrectly (-off - 1) and records writes in slot_type[] using (slot - i) % BPF_REG_SIZE. The sanitization pre-check used slot_type[i],...

CVE-2026-72427

CVE-2026-72427 (Linux kernel) fixes an incorrect indexing of the effective BPF program array when BPF_F_PREORDER is used. The vulnerable path was in replace_effective_prog() (bpf_link_update()) and purge_effective_progs(), which located slots by linearly walking the program hlist. The computed la...

CVE-2026-72426

The CVE-2026-72426 entry describes a Linux kernel vulnerability affecting BPF stack slot cleanup. When cleaning dead stack slots in 4-byte halves, if the high half of a STACK_SPILL is dead and the low half remains live, the low half could be converted to STACK_MISC/STACK_ZERO and its spilled_ptr ...

CVE-2026-72424

CVE-2026-72424 concerns the Linux kernel RTC MSC313 driver. The vulnerability arises when msc313_rtc_probe() calls devm_request_irq() with IRQF_SHARED and the cookie set to &pdev->dev, while platform_set_drvdata() runs later after clock setup. Under a shared IRQ line, another device can fire t...

CVE-2026-72425

In Linux kernel, filtering/redirect (ice) driver had a resource leak in CTRL VSIs when resetting all VFs with FDIR filters enabled. The root cause was CTRL VSIs being invalidated but not freed during ice_reset_all_vfs(); the fix calls ice_vf_ctrl_vsi_release() instead of ice_vf_ctrl_invalidate_vs...

CVE-2026-72423

The CVE-2026-72423 vulnerability affects the Linux kernel’s BPF conntrack error reporting: wrappers for conntrack kfuncs may write to opts->error outside the verifier-checked range, for certain sizes. The issue occurs when using an opts pointer with an accompanying opts__sz argument; the verif...

CVE-2026-72422

Summary: CVE-2026-72422 fixes a use-after-free in ksmbd’s handling of conn->preauth_info during concurrent SMB2 NEGOTIATE on the same Linux kernel connection. The issue arose because the preauth_info state (shared across the negotiate and response paths) could be freed while a concurrent send-...

CVE-2026-72421

CVE-2026-72421 : In the Linux kernel, a logic flaw in IPv4 route lookup under CONFIG_IP_MULTIPLE_TABLES can cause an error route from a merged local/main table to be overwritten by a route in the default table when no rule is added. The issue occurs in fib_lookup() where two tables are searched a...

CVE-2026-72419

The CVE-2026-72419 entry concerns the Linux kernel, specifically netfilter nf_nat/nf_tables paths. Description shows a fix for an invalid nat_net pointer use that could occur after nf_nat_init() fails, with an observed KASAN slab-out-of-bounds report in nf_nat_register_fn guarded by nf_tables cod...

CVE-2026-72420

CVE-2026-72420 : In the Linux kernel, a race was reported between md/raid5 break_stripe_batch_list and raid5_make_request, involving sh->dev[i].flags (non-atomic write vs. atomic bit op) that could trigger a data race on R5_Overlap. The public descriptions provide a scenario where CPU1 clears ...

CVE-2026-72418

The CVE relates to the Linux kernel netfilter nf_conncount/conns tracking fix for connlimit soft-limiting. A regression allowed valid connections to be dropped when a new connection reused a socket in TIME_WAIT, because an assumed-confirmed entry could trigger a garbage-collection-driven drop. Th...

CVE-2026-72417

The CVE-2026-72417 entry concerns the Linux kernel netfilter flowtable path, specifically nf_flow_ip4_tunnel_proto(). The vulnerability arises from processing IPv4 headers without validating iph->ihl, risking out-of-bounds access when headers are malformed. The fix adds a sanity check on iph-&...