CVE-2026-72316

In the Linux kernel vulnerability CVE-2026-72316, the metadata_open() path used by device-mapper metadata handling returns NULL on kzalloc_obj() failure, but era_ctr() only checks IS_ERR(md). Since IS_ERR(NULL) is false, a NULL is treated as valid and later dereferenced (era->md). The fix is t...

CVE-2026-72314

CVE-2026-72314 in the Linux kernel fixes a bug in regulator_lock_two() where the code compared the return value to -EDEADLOCK instead of -EDEADLK after ww_mutex_lock() returns -EDEADLK on contention. This mismatch could cause the lock to not back off and retry correctly, resulting in only one of ...

CVE-2026-72315

The CVE-2026-72315 entry documents a Linux kernel issue in the CIFS/SMB client where a delayed release of a dentry reference count during unmount after DIO could trigger a busy-dentry warning. A fix was implemented in cifs_kill_sb() by flushing deferredclose_wq, and later the problem in the DIO p...

CVE-2026-72313

CVE-2026-72313 concerns the Linux kernel DRM fb-helper: the fix ensures fbdev output is synchronized only to the vblank of an active CRTC. The change iterates the CRTC list and selects the first active CRTC for vblank synchronization, instead of assuming a fixed CRTC. This addresses a warning and...

CVE-2026-72312

CVE-2026-72312 affects the Linux kernel component octeontx2-af and fixes an issue where VF bringup could erroneously modify the PF’s promiscuous/allmulti MCAM rules. The root cause was that mbox handling of nix_set_rx_mode (and related APIs) acted only on the PF, not the VF, potentially clearing ...

CVE-2026-72311

CVE-2026-72311 affects the Linux kernel DRM/XE path. The issue occurs in xe_vm_madvise_ioctl(), which allocates madvise_range.vmas in get_vmas(). When get_vmas() succeeds and later validation fails, control incorrectly jumps to madv_fini, skipping kfree(madvise_range.vmas) and leaking the VMA arr...

CVE-2026-72310

CVE-2026-72310 : In the Linux kernel SMB client, the passthrough ioctl bounds check for smb2_ioctl_query_info() uses 32-bit fields for OutputOffset and input_buffer_length. The code adds these values directly, allowing 32-bit wrap-around, which can let a malicious server craft a large OutputOffse...

CVE-2026-72308

CVE-2026-72308 affects the Linux kernel’s mlxsw port code, where mlxsw_sp_port_lag_join() can leak a refcount if mlxsw_sp_port_lag_index_get() fails. The issue arises when an error path bypasses the standard cleanup that releases the lag reference with mlxsw_sp_lag_put(), leading to a single miss...

CVE-2026-72309

The CVE-2026-72309 vulnerability affects the Linux kernel’s tracing/remotes path. It fixes a leak in trace_remote_alloc_buffer() error path: if page allocation fails, desc->nr_cpus is not yet incremented for the current CPU, which can cause a half-allocated rb_desc to remain unreleased in trac...

CVE-2026-72307

CVE-2026-72307 describes a Linux kernel issue in the mlxsw path where, after replacing VRs, the error rollback loop failed to update the vr pointer, causing a refcount leak of new_tree if replacements were partially completed. The root cause: the loop variable could point at the wrong VR, causing...

CVE-2026-72306

The CVE-2026-72306 entry concerns a race in the Linux kernel’s vduse subsystem, specifically between vduse_dev_msg_sync and vduse_dev_read_iter. The issue arises when vduse_dev_read_iter dequeues a message under lock, while vduse_dev_msg_sync later checks and may delete a completed message, riski...

CVE-2026-72305

Consolidated details show CVE-2026-72305 affects the Linux kernel VDUSE subsystem, where bounce pages mapped to userspace may leak kernel information due to non-page-aligned bounce handling. Mitigation: allocate bounce pages with __GFP_ZERO to prevent leaking data to userspace. The vulnerability ...

CVE-2026-72304

CVE-2026-72304: Linux kernel ASoC SOF IPC4 control TOCTOU in sof_ipc4_bytes_put. The bug arose from copying data using the old data->size instead of the incoming sof_abi_hdr.size from ucontrol, which could copy stale bytes or truncate valid data when sizes differ. The connected sources confirm...

CVE-2026-72302

The CVE-2026-72302 entry documents a Linux kernel flaw in ASoC: SOF ipc3-control where sof_ipc3_control_update() used firmware-provided cdata->num_elems in arithmetic that could overflow on 32-bit platforms. This overflow could let cdata->rhdr.hdr.size comparisons pass with mismatched sizes...

CVE-2026-72303

In the Linux kernel, the ASoC: SOF: ipc4-control vulnerability fixes validation of MODULE_NOTIFICATION payload length before reading bytes/channel data in control update handling. Root cause was insufficient payload size checks in the control update path, with CVSSv3.1 base score 7.8 (Local, Low ...

CVE-2026-72301

Summary (CVE-2026-72301) The Linux kernel's ASoC: SOF ipc3-control component exposes a TOCTOU fix in sof_ipc3_bytes_put/bytes_get. The issue arises because memcpy length in sof_ipc3_bytes_put() used the old data->size from the buffer rather than the incoming data’s sof_abi_hdr.size, risking tr...

CVE-2026-72299

CVE-2026-72299 affects the Linux kernel's TIPC code path. The issue arises when tipc_sk_enqueue() runs with sk_lock held in user context and the TIPC_DUMP_ALL tracepoints dump sk_receive_queue, risking dereferencing skbs that the socket owner has already dequeued or freed. The fix limits the unsa...

CVE-2026-72300

The CVE-2026-72300 entry concerns the Linux kernel, specifically the ASoC: SOF topology parser. The vulnerability arises in sof_parse_token_sets() when it reads array->size during topology private-data parsing, potentially reading the size field before a complete snd_soc_tplg_vendor_array head...

CVE-2026-72298

The CVE-2026-72298 entry describes a 32-bit residual in the Linux kernel’s qrtr_endpoint_post() that could allow out-of-bounds writes: if size comes from the wire and satisfies len == ALIGN(size,4) + hdrlen, 32-bit size_t wraps to 0 for large values, causing skb_put_data to write past the skb hea...

CVE-2026-72297

CVE-2026-72297 : Linux kernel vulnerability in ATM QoS validation. The issue arises when QoS is accepted and larger traffic_class values are not rejected, leaving vcc->qos with invalid values. This can lead to an out-of-bounds read in /proc/net/atm/pvc when indexing class_name[] with vcc->q...