CVE-2026-72223

The CVE-2026-72223 entry concerns the Linux kernel, specifically the nvdimm/btt component. The vulnerability stems from memory allocated by btt_freelist_init(), btt_rtt_init(), and btt_maplocks_init() not being freed on certain discover_arenas() error paths, causing a memory leak when arena disco...

CVE-2026-72222

The CVE-2026-72222 entry corresponds to a Linux kernel vulnerability in the sunrpc TLS handshake path. The issue arises from races where an in-flight async TLS handshake callback can write through a freed svc_sock, due to the embedding svc_sock being container_of() referenced after tls_handshake_...

CVE-2026-72221

The CVE describes a race in the Linux kernel sunrpc TLS handshake path. When wait_for_completion_interruptible_timeout() times out or is interrupted, handshake_complete() may race with tls_handshake_cancel(): if the handshake callback has set HANDSHAKE_F_REQ_COMPLETED or XPT_TLS_SESSION but not y...

CVE-2026-72220

CVE-2026-72220 affects the Linux kernel sunrpc subsystem. The issue arises from a potential double-free or use-after-free when a worker thread starts a new request and encounters an early error before rq_procinfo is installed, leaving a stale release hook tied to prior RPC state. A set of fixes H...

CVE-2026-72219

The CVE-2026-72219 entry concerns a leak in the Linux kernel’s lockd: nlm_file allocations are not freed on nlm_do_fopen() failure. After kzalloc_obj() succeeds in nlm_lookup_file(), the new nlm_file isn’t yet in nlm_files[] when the failure path jumps to out_unlock, releasing nlm_file_mutex and ...

CVE-2026-72218

The CVE-2026-72218 entry describes a Linux kernel lockd file refcount leak in nlm_lookup_file() when nlm_do_fopen() fails on a hashed nlm_file. The cached-file path reaches the found: label unconditionally, causing *result and file->f_count to be updated before the error is returned. Wrappers ...

CVE-2026-72216

In the Linux kernel, CVE-2026-72216 affects the remoteproc/qcom path, where a leak occurs when adding custom dump_segments fails. The fix frees the allocated minidump_region 'name' if the region is not added to dump_segments, preventing a leak; it also ensures an error is returned when adding to ...

CVE-2026-72217

The CVE-2026-72217 issue concerns SUNRPC in the Linux kernel where xdr_buf_to_bvec() writes a bio_vec before validating the destination slot, allowing an out-of-bounds write when budget is exhausted. The rq_bvec array used by nfsd_vfs_write() is allocated to rq_maxpages with no slack, so an overf...

CVE-2026-72215

CVE-2026-72215 affects the Linux kernel on MIPS under 64-bit configurations. The issue arises when non-initial kernel threads call firmware entry points; the stack may be placed in XKPHYS 64-bit memory, making the stack pointer effectively 64-bit. Consequently, 32-bit ALU operations by 32-bit fir...

CVE-2026-72214

The CVE relates to the Linux kernel driver power: supply: cpcap-battery. A reference leak occurs in cpcap_battery_detect_battery_type() where an nvmem_device obtained via nvmem_device_find() is not released with nvmem_device_put() on success or read-failure paths, allowing a permanent reference t...

CVE-2026-72212

CVE-2026-72212 : In the Linux kernel, a bug in memory hotplug could lead to memory corruption. When arch_add_memory() succeeds with memmap_on_memory, vmemmap pages are allocated from params.altmap; if create_memory_block_devices() later fails, arch_remove_memory() was called with a NULL altmap in...

CVE-2026-72213

CVE-2026-72213 affects the Linux kernel hugetlb code path. The issue arises from using a single h_cg pointer for both rsvd and non-rsvd cgroup charges in alloc_hugetlb_folio(), causing the rsvd pointer to be overwritten and leading to a page_counter underflow during folio cleanup. The fix introdu...

CVE-2026-72211

The CVE concerns the Linux kernel NTFS handling in ntfs_ir_reparent(), where a root stub may grow beyond the resident index root value. The code can publish a larger index header (index_length/allocated_size) before resizing the resident value, so if a resize fails with ENOSPC, recovery paths may...

CVE-2026-72210

The CVE relates to the Linux kernel ntfs decoding path: in ntfs_mapping_pairs_decompress, attr_end points one byte past the attribute end, and two bounds checks used strict greater-than; this permits a one-byte out-of-bounds read when the data extends to attr_end. The root cause is using > ins...

CVE-2026-72208

CVE-2026-72208 affects the Linux kernel NTFS EA handling code. The vulnerability arises from insufficient bounds checking in ntfs_ea_lookup and ntfs_listxattr, where the code accesses the next_entry_offset field of an EA entry without verifying there is enough space. The issue is resolved in the ...

CVE-2026-72209

CVE-2026-72209 concerns the Linux kernel NTFS attribute value handling. The fix adds a shared attribute value validator and applies it before any lookup path can return an attribute (including AT_UNUSED). The validator enforces bounds for resident values, minimum resident sizes, checks variable-l...

CVE-2026-72207

The CVE-2026-72207 entry concerns the Linux kernel NTFS handling: when resizing a resident NTFS attribute, ntfs_resident_attr_resize() attempts to free space by converting other resident attributes to non-resident; the vulnerability arises if 0-byte resident $DATA attributes are considered for co...

CVE-2026-72206

The CVE-2026-72206 entry concerns the Linux kernel NTFS index block validation. A stricter validation was added for INDEX_HEADER geometry in INDX blocks via ntfs_index_block_inconsisent(), and ntfs_lookup_inode_by_name() was updated to use this validation. This fixes a vulnerability in how INDX b...

CVE-2026-72204

In the Linux kernel NTFS code, CVE-2026-72204 targets the validation of the $INDEX_ROOT header. A dedicated helper was added to perform stricter validation of $INDEX_ROOT and is used for both directory inodes and named index inodes, ensuring consistent checks on root size and header geometry acro...

CVE-2026-72205

The CVE-2026-72205 entry concerns a Linux kernel ntfs mount failure leak: on fill_super error paths, vol-owned allocations (nls_map, volume_label) and lcn_empty_bits_per_page were not freed, leading to per‑mount leaks until module unload. The issue affects ntfs_fill_super() and err_out_now paths,...