CVE-2026-72264

The CVE-2026-72264 issue is in the Linux kernel’s fbdev/tridentfb code. In trident_pci_probe(), memory allocated for a modelist via fb_videomode_to_modelist() may not be freed along error paths, creating a potential memory leak. The fix ensures the modelist is destroyed with fb_destroy_modelist()...

CVE-2026-72261

Summary: CVE-2026-72261 affects the Linux kernel ASoC: SOF ipc3-control path. In snd_sof_update_control, the code validates firmware-provided cdata->num_elems against local_cdata->data->size but does not verify it against the actual allocation size. If local_cdata->data->size was p...

CVE-2026-72262

CVE-2026-72262 : In the Linux kernel ASoC SOF ipc3-control pathway, there is a heap overflow in bytes_ext_put/get due to incorrect bounds checks on the ipc_control_data buffer. The cdata->data payload sits after the struct and max_size was evaluated against the entire allocation, allowing writ...

CVE-2026-72260

CVE-2026-72260 (Linux kernel, ASoC MT8192) : The vulnerability arises in the MT8192 AFE probe where runtime PM is enabled during regmap cache reinitialization and pm_runtime_get_sync() is called without validating its return value. If runtime resume fails, the probe continues, potentially leaving...

CVE-2026-72259

In the Linux kernel ASoC: mediatek mt8192 driver, reserved memory assigned during MT8192 AFE probe was not released on success. The issue is fixed by registering a devm cleanup action so the reserved-memory assignment is released on probe failure or driver unbind. This mode highlights the specifi...

CVE-2026-72258

CVE-2026-72258 concerns the Linux kernel ASoC: mediatek mt8183 driver. The issue is that the MT8183 AFE probe can assign reserved memory via of_reserved_mem_device_init(), but the reservation is not released when the driver is removed or on subsequent probe failures. The flaw is resolved by regis...

CVE-2026-72257

CVE-2026-72257 affects the Linux kernel ASoC qcom stack (q6apm). The root cause is a potential NULL pointer dereference in graph_callback when a late DSP buffer-done response races with q6apm_free_fragments() which frees and NULLs rx/tx buffers under graph->lock. The code path can dereference ...

CVE-2026-72256

CVE-2026-72256 (Linux kernel netfilter xt_cluster) : The issue arises in xt_cluster_mt() which treats any non-NULL nf_ct_get() result as a fully initialized conntrack and passes it to xt_cluster_hash(). When a template conntrack is attached to skb->_nfct before normal processing, it carries IP...

CVE-2026-72254

The CVE-2026-72254 entry concerns the Linux kernel netfilter NFT_FIB logic. A fib expression in a netdev egress base chain could dereference nft_in(pkt) on the transmit path, yielding a NULL pointer dereference during eval. The root cause is that nft_fib_validate() masks the hook with NF_INET_* v...

CVE-2026-72255

The CVE affects the Linux kernel, specifically netfilter nf_queue interactions with bridged traffic. A br_netfilter fake rtable is embedded in struct net_bridge and attached to bridged packets via skb_dst_set_noref. When such a packet is queued to NFQUEUE, __nf_queue() upgrades the fake dst with ...

CVE-2026-72253

Summary (CVE-2026-72253) : In the Linux kernel, the netfilter nf_conntrack_sip path is fixed to validate skb_dst() before use. The SIP helper relies on skb_dst() being present when sip_external_media is enabled, but tc ingress and Open vSwitch may not guarantee routing information, so the toggle ...

CVE-2026-72252

CVE-2026-72252 affects the Linux kernel netfilter nft_set_pipapo mechanism. On memory allocation failure, the cloned nft_pipapo_match can enter a bad state where lookup tables may be resized inconsistently, bits toggled, and the scratch map undersized, enabling a subsequent insertion in the same ...

CVE-2026-72250

The CVE-2026-72250 entry documents a Linux kernel vulnerability in netfilter nf_conntrack_reasm where IPv6 defragmentation erroneously adjusts skb->mac_header. Specifically, nf_ct_frag6_reasm() advances skb->mac_header after dropping the IPv6 fragment header, but on NF_INET_LOCAL_OUT the ma...

CVE-2026-72251

CVE-2026-72251 concerns the Linux kernel netfilter nf_nat_sip path. The issue is a memory-pointer/buffer handling flaw: if skb_ensure_writable() reallocates a cloned/fragmented skb, nf_nat_sip() may not update the destination pointer (dptr ) to the new buffer, risking a stale data pointer and pot...

CVE-2026-72249

The CVE-2026-72249 entry documents a Linux kernel netfilter flowtable bug: when pushing IPIP headers, the code uses the wrong direction’s route to calculate headroom, causing iph->frag_off and headroom handling to be incorrect. The issue arises from accessing the other tuple to set IP source/d...

CVE-2026-72248

The CVE-2026-72248 entry pertains to the Linux kernel netfilter flowtable: IPIP tunnels with direct xmit can crash the tunnel transmit path due to missing dst_entry when checking headroom and setting iph->frag_off. The workaround/patch moves dst_cache and dst_cookie out of the runtime union so...

CVE-2026-72247

The CVE-2026-72247 issue affects the Linux kernel netfilter nf_conncount dedup logic. Root cause: in __nf_conncount_add(), the code used zone->dir (a u8 bitmask) as the direction argument to nf_ct_zone_id()/nf_ct_zone_equal(), which misinterpreted the direction and could cause incorrect zone I...

CVE-2026-72246

CVE-2026-72246 — Linux kernel netfilter flowtable: The issue arises in the path that handles tunneling (Layer 2/3) during transmission, where tunnel information used for hashtable lookups could be sourced from the wrong direction, causing incorrect egress encapsulation. The patch fixes the tunnel...

CVE-2026-72245

CVE-2026-72245 relates to the Linux kernel GPU host1x driver, where a reference leak could occur in host1x_device_parse_dt() after device_initialize(). The embedded struct device was freed directly via kfree(device) in the error path, bypassing normal device lifetime handling and leaking a refere...

CVE-2026-72244

CVE-2026-72244 concerns the Linux kernel gpu/buddy allocator. The bug in try_harder contiguous fallback could return a range whose start offset didn’t match the caller’s min_block_size. The fix realigns misaligned candidates by freeing the misaligned run and reallocating exactly @size at the next...