CVE-2026-72277

Summary (CVE-2026-72277): In the Linux kernel’s KVM for arm64, the L1 VNCR mapping logic now rejects non-memory PFNs when constructing VNCR mappings, due to unconditional use of cacheable memory attributes that could trigger an SError on writeback. The vulnerability affected KVM’s handling of VNC...

CVE-2026-72276

CVE-2026-72276 concerns the Linux kernel fbdev/metronomefb subsystem. The issue is a memory leak where pagerefs allocated in fb_deferred_io_init() are not freed on error paths during metronomefb_probe(), leading to leaked resources. The documented fix is to call fb_deferred_io_cleanup() on error ...

CVE-2026-72275

The CVE concerns the Linux kernel fbdev driver for broadsheetfb. A memory leak was introduced where pagerefs allocated in fb_deferred_io_init() were not freed on error paths in broadsheetfb_probe(). The issue is fixed by invoking fb_deferred_io_cleanup() to release the allocated resources. The do...

CVE-2026-72274

The CVE-2026-72274 entry concerns the Linux kernel fbdev driver, specifically the hecubafbProbe path. A memory leak was introduced where the pagerefs allocated in fb_deferred_io_init() were not freed on the error path. The issue is resolved by calling fb_deferred_io_cleanup() to release those res...

CVE-2026-72273

The CVE-2026-72273 entry corresponds to a Linux kernel issue in fbdev/efifb where a string returned by fb_get_options() was not freed in efifb_probe(), causing a memory leak. The root cause follows the 73ce73c30ba9 commit that clarified ownership and transfer of video option strings; the fix is t...

CVE-2026-72272

The CVE-2026-72272 entry concerns the Linux kernel’s fbdev: radeon component. It describes a memory-leak in radeonfb_pci_register() where modelist memory allocated by radeon_check_modes()/fb_add_videomode() is appended to info->modelist but not freed on error paths, with the fix implemented by...

CVE-2026-72271

The CVE pertains to Linux kernel fbdev/i740fb: a memory leak in i740fb_probe where memory allocated by fb_videomode_to_modelist() for modelist was not freed in error paths. The issue is resolved by calling fb_destroy_modelist() to free the allocated modelist in all error paths. Affected component...

CVE-2026-72270

The connected documents confirm a concrete issue in the Linux kernel’s fbdev/s3fb driver: in s3_pci_probe(), memory allocated for modelist via fb_videomode_to_modelist() was not freed on error paths, causing a potential memory leak. The remediation is to free this resource by calling fb_destroy_m...

CVE-2026-72268

The CVE-2026-72268 entry concerns the Linux kernel fbdev driver tdfxfb. In tdfxfb_probe, memory is allocated for a modelist via fb_videomode_to_modelist() when CONFIG_FB_3DFX_I2C is defined, but this memory is not freed along error paths. The fix is to call fb_destroy_modelist() to release the al...

CVE-2026-72269

In the Linux kernel, the fbdev driver uvesafb had a memory-leak in the probe path: memory allocated for modedb and modelist in uvesafb_vbe_init() could be leaked on some error paths due to an incorrect goto label. The issue is resolved by updating the goto label in the error handling. This affect...

CVE-2026-72266

The CVE-2026-72266 entry concerns a memory-leak in the Linux kernel’s vesafb path under fbdev. The root cause is that a string returned by fb_get_options() was not freed by vesafb_probe() after setup, despite an earlier change that the caller should free the string. The issue has been resolved by...

CVE-2026-72267

CVE-2026-72267 affects the Linux kernel fbdev CarmineFB component. The issue is a memory leak: modelist allocated in fb_videomode_to_modelist() is not freed on error paths, addressed by calling fb_destroy_modelist(). Connected sources confirm the exact fix and function sequence across multiple ke...

CVE-2026-72265

In the Linux kernel, CVE-2026-72265 fixes a memory leak in fbdev/nvidiafb_probe. In nvidiafb_probe(), memory allocated for modelist in nvidia_set_fbinfo() was not freed on error paths; the fix calls fb_destroy_modelist() to free it. No exploitation details are provided in the documents.

CVE-2026-72263

The CVE-2026-72263 issue affects the Linux kernel ASoC: SOF topology loader. When a topology filename contains "dummy" and tplg_cnt is 0, snd_sof_load_topology returns -EINVAL without freeing the allocated tplg_files (kcalloc), causing a memory leak on such loads. The fixed behavior sets ret = -E...

CVE-2026-72264

The CVE-2026-72264 issue is in the Linux kernel’s fbdev/tridentfb code. In trident_pci_probe(), memory allocated for a modelist via fb_videomode_to_modelist() may not be freed along error paths, creating a potential memory leak. The fix ensures the modelist is destroyed with fb_destroy_modelist()...

CVE-2026-72261

Summary: CVE-2026-72261 affects the Linux kernel ASoC: SOF ipc3-control path. In snd_sof_update_control, the code validates firmware-provided cdata->num_elems against local_cdata->data->size but does not verify it against the actual allocation size. If local_cdata->data->size was p...

CVE-2026-72262

CVE-2026-72262 : In the Linux kernel ASoC SOF ipc3-control pathway, there is a heap overflow in bytes_ext_put/get due to incorrect bounds checks on the ipc_control_data buffer. The cdata->data payload sits after the struct and max_size was evaluated against the entire allocation, allowing writ...

CVE-2026-72260

CVE-2026-72260 (Linux kernel, ASoC MT8192) : The vulnerability arises in the MT8192 AFE probe where runtime PM is enabled during regmap cache reinitialization and pm_runtime_get_sync() is called without validating its return value. If runtime resume fails, the probe continues, potentially leaving...

CVE-2026-72259

In the Linux kernel ASoC: mediatek mt8192 driver, reserved memory assigned during MT8192 AFE probe was not released on success. The issue is fixed by registering a devm cleanup action so the reserved-memory assignment is released on probe failure or driver unbind. This mode highlights the specifi...

CVE-2026-72258

CVE-2026-72258 concerns the Linux kernel ASoC: mediatek mt8183 driver. The issue is that the MT8183 AFE probe can assign reserved memory via of_reserved_mem_device_init(), but the reservation is not released when the driver is removed or on subsequent probe failures. The flaw is resolved by regis...