CVE-2026-72348

The CVE-2026-72348 entry concerns the Linux kernel netfilter ip6tables handling of IPv6 extension headers (ah, hbh, rt). The issue stems from checks that derive the advertised extension header length from header length fields; improper advertised-length checks allowed malformed headers to bypass ...

CVE-2026-72349

The CVE-2026-72349 entry concerns the Linux kernel netfilter xt_rateest component. Affected function xt_rateest_mt() truncates 64-bit byte-rate values to 32-bit when the link exceeds ~34 Gbps, causing incorrect comparison results as the estimator rate can exceed 2^32-1 (~4.3 GB/s). The fix is to ...

CVE-2026-72347

CVE-2026-72347 – Linux kernel netfilter xt_connmark vulnerability affecting the CONNMARK target (revision 2). The issue arises when user-controlled shift parameters are applied to 32-bit connmark values via the function in the connmark_tg_shift() path. A shift_bits value of 32 or more triggers an...

CVE-2026-72346

The CVE describes a NULL pointer dereference in the Linux kernel's platform/x86 bitland-mifs-wmi driver during suspend/resume. The kernel initializes two WMI devices (BITLAND_WMI_CONTROL and BITLAND_WMI_EVENT); during probe, the event path exits early, leaving data->pp_dev NULL. Global PM slee...

CVE-2026-72345

CVE-2026-72345 affects the Linux kernel mlx5 LAG handling. The vulnerability arises in the single-FDB error rollback: on failure at index i, the reverse cleanup loop in mlx5_lag_create_single_fdb() starts from i, risking rollback of the failed index or double-tearing down a rule already self-roll...

CVE-2026-72344

Summary: CVE-2026-72344 affects the Linux kernel mlx5e features for TC offloads. The issue occurs when cleaning up peer flows in a Link Aggregation Group (LAG) if the peer is not in the LAG or no master is marked, causing mlx5_lag_get_dev_seq() to return an error, which can lead to bad memory acc...

CVE-2026-72343

Summary: Multiple sources report in the Linux kernel net/mlx5e HV VHCA stats path a zero-sized buffer allocation bug that can lead to a fault when stats are enabled. The root cause was calling kvzalloc(0) via mlx5e_hv_vhca_stats_create() before priv->stats_nch is populated, resulting in a ZERO...

CVE-2026-72342

The CVE-2026-72342 issue affects the Linux kernel’s net/mlx5e HV VHCA stats path. The race occurs in mlx5e_hv_vhca_stats_create() when publishing the stats agent via mlx5_hv_vhca_agent_create(): the agent is published and a delayed invalidation is scheduled before priv->stats_agent.agent and p...

CVE-2026-72340

The CVE covers a Linux kernel vulnerability in the net: microchip: vcap subsystem where VCAP instances share a single Super VCAP block. The issue arises because independently-locked instances race when accessing shared hardware (cache and registers), allowing out-of-sync operations to corrupt the...

CVE-2026-72341

CVE-2026-72341 affects the Linux kernel net/mlx5e: a publication race in priv->channel_stats[] where mlx5e_channel_stats_alloc() writes channel_stats[ix] before updating stats_nch, without memory barriers. On weakly-ordered architectures (ARM, PowerPC, RISC-V) readers may observe stats_nch == ...

CVE-2026-72339

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-72337

CVE-2026-72337 : Linux kernel memory safety issue in Bluetooth 6lowpan handling. The flaw stems from lowpan_enable_set() allocating a temporary work item and scheduling do_enable_set() on system_wq, while the debugfs write returns and the worker may run later, potentially operating on stale state...

CVE-2026-72338

Technical details about CVE-2026-72338 are not publicly available in the provided documents. The materials summarize the issue at a high level. Monitor for updated advisories or full exploit specifics from official sources.

CVE-2026-72336

CVE-2026-72336 — Linux kernel, Bluetooth 6lowpan L2CAP hold across debugfs control Root cause: get_l2cap_conn() looks up an LE hci_conn under hdev protection, then drops protection before reading hcon->l2cap_data and before lowpan_control_write() dereferences conn->hcon, allowing a disconne...

CVE-2026-72334

Summary: CVE-2026-72334 affects the Linux kernel Bluetooth ISO handling. The issue arises from malformed ISO_END/ISO_CONT packets not being excluded by the Core spec, which can leak memory and trigger panics. The documented scenarios include: ISO_START with rx_len=4, ISO_CONT skb->len=4, ISO_S...

CVE-2026-72335

CVE-2026-72335 — Linux kernel Bluetooth MGMT fix : The vulnerability is in the MGMT path used by the Bluetooth HCI management code when adding a new adv_monitor. In hci_add_adv_monitor, an adv_monitor is published in hdev->adv_monitors_idr before the powered MSFT offload setup. If the MSFT add...

CVE-2026-72333

CVE-2026-72333 concerns a Linux kernel Bluetooth L2CAP TX identifier leak. The fix was to adjust ident allocation to use an IDA and ensure idents are released when responses arrive, but identifiers allocated for commands without responses (notably LE CREDITS) were not released, allowing exhaustio...

CVE-2026-72331

CVE-2026-72331 affects the Linux kernel. The vulnerability arises in the accel/amdxdna path where, in functions aie2_populate_range() and amdxdna_umap_release() , a saved VMA pointer may have already been freed, leading to a potential use-after-free due to VMA accesses. The issue is resolved by r...

CVE-2026-72332

The CVE-2026-72332 issue affects the Linux kernel’s accel/amdxdna path. The problem arises when amdxdna_hwctx_sync_debug_bo() calls the hardware hwctx_sync_debug_bo() callback while xdna->dev_lock is held. The callback may invoke amdxdna_cmd_submit(), which calls amdxdna_pm_resume_get(); if th...

CVE-2026-72330

The CVE-2026-72330 entry documents a Linux kernel vulnerability in the TLS data path. A peer can send a zero-length TLS application_data record (TLS 1.3 allows these as a traffic-analysis countermeasure). After decryption such a record has full_len == 0 and, in tls_sw_read_sock(), the read loop r...