CVE-2026-72151

CVE-2026-72151 — Linux kernel : The tpm2-sessions path (tpm_buf_append_salt in drivers/char/tpm/tpm2-sessions.c) calls crypto_kpp_generate_public_key() and crypto_kpp_compute_shared_secret() without a completion callback, discards both return values, and immediately frees the kpp_request. For asy...

CVE-2026-72150

The CVE-2026-72150 issue affects the Linux kernel sunrpc subsystem. The xprt_create_args structure was allocated on the stack without initialization in rpc_sysfs_xprt_switch_add_xprt_store(), leaving fields such as srcaddr, bc_xps, and flags with garbage data. This can cause kernel panic when xs_...

CVE-2026-72149

The CVE-2026-72149 entries describe a Linux kernel vulnerability in the Tegra GPC DMA engine where transfer lengths not divisible by the configured max burst size cause a hang due to partial bursts. The root cause is a burst size calculation that assumed lengths would align with the max burst, wh...

CVE-2026-72147

The CVE-2026-72147 issue affects the Linux kernel’s dmaengine dw-edma-pcie driver. In dw_edma_pcie_probe, the PCI device ID driver_data is treated as the controller layout template and copied unconditionally. A device bound dynamically via sysfs can match the driver without that data, leading to ...

CVE-2026-72148

The CVE-2026-72148 vulnerability affects the Linux kernel’s dmaengine dw-edma driver. The DONE_INT_MASK and ABORT_INT_MASK registers are shared across DMA channels and are updated via non-atomic read-modify-write sequences, enabling race conditions when two channels update them concurrently. Miti...

CVE-2026-72146

CVE-2026-72146 concerns the Linux kernel dmaengine rz-dmac issue. In the fix, the interrupt request is moved to occur after full setup, preventing the IRQ handler from accessing channel->ch_base before initialization and the IRQ thread from touching uninitialized data (ld_free, ld_queue, ld_ac...

CVE-2026-72145

The documents confirm CVE-2026-72145 affects Linux kernel code in platform/x86/intel/tpmi. The mem_write() path now uses cleanup.h scope-based cleanup to automatically free a temporary array returned by parse_int_array_user(), ensuring release on all exit paths. The array declaration was moved ne...

CVE-2026-72143

CVE-2026-72143 (Linux kernel, platform/x86 ISST): Affected code path restores SST-PP control to all domains after resume. The bug is that the SST-PP control offset is restored incorrectly (only to power domain 0 after resume) while suspend stores control values for all domains. The fix changes us...

CVE-2026-72144

Summary (CVE-2026-72144) In the Linux kernel, the Dell X Dell-laptop platform had an init error path cleanup issue in dell_init(): if a later LED or backlight registration failed, not all resources were torn down. Specifically, after dell_setup_rfkill(), resources such as the notifier, debugfs di...

CVE-2026-72142

CVE-2026-72142 affects the Linux kernel i2c/imx driver, fixing a locked bus on SMBus block-read of 0 (atomic). The vulnerability occurs when SMBus 3.1 6.5.7 allows a Block Read byte count of 0 but the atomic path rejects it (-EPROTO) and can start a new receive cycle, leaving SDA held and the bus...

CVE-2026-72140

CVE-2026-72140 relates to the Linux kernel, specifically the i2c mlxbf subsystem. The vulnerability arises in mlxbf_i2c_init_resource() when devm_platform_get_and_ioremap_resource() returns an error: tmp_res is freed before tmp_res->io is read to obtain the error code, causing a use-after-free...

CVE-2026-72141

CVE-2026-72141 covers a Linux kernel issue in the i2c/imx SMBus path where a Block Read with a count of 0 could cause the bus to stay locked. The vulnerability arises because the interrupt-driven state machine incorrectly handles -EPROTO for a zero-byte block read, failing to issue a NACK+STOP an...

CVE-2026-72139

The CVE concerns a Linux kernel race where per-socket authentication data (md5sig/md5sig_key) could be freed before an RCU grace period elapses during tcp_connect. In the vulnerable path, two branches (needs_md5 and needs_ao) free the md5sig_info or its keys while a socket is in TCP_SYN_SENT, ris...

CVE-2026-72138

The CVE describes a Linux kernel issue in xen/gntdev where gntdev_ioctl_map_grant_ref() could leak memory if copy_to_user() failed after adding a mapping and not releasing the acquired reference. The root cause involves mismanaged error paths: on failure to copy operation results back to userspac...

CVE-2026-72137

CVE-2026-72137 : In the Linux kernel, the xfrm nat_keepalive path suffers a double-free of the keepalive skb on send errors. Specifically, nat_keepalive_send() frees the skb when IPv4/IPv6 send helpers report an error, but after ip_build_and_send_pkt() or ip6_xmit() takes ownership the cleanup is...

CVE-2026-72136

CVE-2026-72136 affects the Linux kernel, specifically the xfrm subsystem and the xfrm_interface changelink flow. The root cause is a netns permission check mismatch: xfrmi_changelink() can be invoked in a caller’s netns that has CAP_NET_ADMIN, while the target interface may reside in a different ...

CVE-2026-72135

The CVE-2026-72135 entry documents a Linux kernel TPM character device security fix. The vulnerability arose because TPM character devices left FMODE_PREAD and FMODE_PWRITE enabled, allowing an unchecked offset during a sequential read path (pread/preadv with offset 0x1400) to form data_buffer + ...

CVE-2026-72134

The CVE describes a Linux kernel issue in the i.MX ECSPI driver: when a DMA transfer is not possible, the driver falls back to PIO but does not undo prior DMA settings (CTRL.SMC, dynamic_burst), causing data corruption on subsequent PIO transfers. The root cause is that, if dmaengine_prep_slave_s...

CVE-2026-72133

CVE-2026-72133 concerns the Linux kernel SPI uniphier driver. The vulnerability arises because devm_request_irq() could be called before init_completion(), allowing an interrupt to occur and the handler to call complete() on an uninitialized completion, causing undefined behavior (observed with K...

CVE-2026-72132

The CVE-2026-72132 issue affects the Linux kernel’s NFS writeback accounting. When a folio is split into multiple requests, the code could erroneously charge or uncharge NR_WRITEBACK/WB_WRITEBACK by the entire folio size for each request, inflating accounting by up to N× and potentially pushing d...