CVE-2026-72147

The CVE-2026-72147 issue affects the Linux kernel’s dmaengine dw-edma-pcie driver. In dw_edma_pcie_probe, the PCI device ID driver_data is treated as the controller layout template and copied unconditionally. A device bound dynamically via sysfs can match the driver without that data, leading to ...

CVE-2026-72146

CVE-2026-72146 concerns the Linux kernel dmaengine rz-dmac issue. In the fix, the interrupt request is moved to occur after full setup, preventing the IRQ handler from accessing channel->ch_base before initialization and the IRQ thread from touching uninitialized data (ld_free, ld_queue, ld_ac...

CVE-2026-72145

The documents confirm CVE-2026-72145 affects Linux kernel code in platform/x86/intel/tpmi. The mem_write() path now uses cleanup.h scope-based cleanup to automatically free a temporary array returned by parse_int_array_user(), ensuring release on all exit paths. The array declaration was moved ne...

CVE-2026-72143

CVE-2026-72143 (Linux kernel, platform/x86 ISST): Affected code path restores SST-PP control to all domains after resume. The bug is that the SST-PP control offset is restored incorrectly (only to power domain 0 after resume) while suspend stores control values for all domains. The fix changes us...

CVE-2026-72144

Summary (CVE-2026-72144) In the Linux kernel, the Dell X Dell-laptop platform had an init error path cleanup issue in dell_init(): if a later LED or backlight registration failed, not all resources were torn down. Specifically, after dell_setup_rfkill(), resources such as the notifier, debugfs di...

CVE-2026-72142

CVE-2026-72142 affects the Linux kernel i2c/imx driver, fixing a locked bus on SMBus block-read of 0 (atomic). The vulnerability occurs when SMBus 3.1 6.5.7 allows a Block Read byte count of 0 but the atomic path rejects it (-EPROTO) and can start a new receive cycle, leaving SDA held and the bus...

CVE-2026-72141

CVE-2026-72141 covers a Linux kernel issue in the i2c/imx SMBus path where a Block Read with a count of 0 could cause the bus to stay locked. The vulnerability arises because the interrupt-driven state machine incorrectly handles -EPROTO for a zero-byte block read, failing to issue a NACK+STOP an...

CVE-2026-72140

CVE-2026-72140 relates to the Linux kernel, specifically the i2c mlxbf subsystem. The vulnerability arises in mlxbf_i2c_init_resource() when devm_platform_get_and_ioremap_resource() returns an error: tmp_res is freed before tmp_res->io is read to obtain the error code, causing a use-after-free...

CVE-2026-72139

The CVE concerns a Linux kernel race where per-socket authentication data (md5sig/md5sig_key) could be freed before an RCU grace period elapses during tcp_connect. In the vulnerable path, two branches (needs_md5 and needs_ao) free the md5sig_info or its keys while a socket is in TCP_SYN_SENT, ris...

CVE-2026-72138

The CVE describes a Linux kernel issue in xen/gntdev where gntdev_ioctl_map_grant_ref() could leak memory if copy_to_user() failed after adding a mapping and not releasing the acquired reference. The root cause involves mismanaged error paths: on failure to copy operation results back to userspac...

CVE-2026-72137

CVE-2026-72137 : In the Linux kernel, the xfrm nat_keepalive path suffers a double-free of the keepalive skb on send errors. Specifically, nat_keepalive_send() frees the skb when IPv4/IPv6 send helpers report an error, but after ip_build_and_send_pkt() or ip6_xmit() takes ownership the cleanup is...

CVE-2026-72136

CVE-2026-72136 affects the Linux kernel, specifically the xfrm subsystem and the xfrm_interface changelink flow. The root cause is a netns permission check mismatch: xfrmi_changelink() can be invoked in a caller’s netns that has CAP_NET_ADMIN, while the target interface may reside in a different ...

CVE-2026-72135

The CVE-2026-72135 entry documents a Linux kernel TPM character device security fix. The vulnerability arose because TPM character devices left FMODE_PREAD and FMODE_PWRITE enabled, allowing an unchecked offset during a sequential read path (pread/preadv with offset 0x1400) to form data_buffer + ...

CVE-2026-72134

The CVE describes a Linux kernel issue in the i.MX ECSPI driver: when a DMA transfer is not possible, the driver falls back to PIO but does not undo prior DMA settings (CTRL.SMC, dynamic_burst), causing data corruption on subsequent PIO transfers. The root cause is that, if dmaengine_prep_slave_s...

CVE-2026-72132

The CVE-2026-72132 issue affects the Linux kernel’s NFS writeback accounting. When a folio is split into multiple requests, the code could erroneously charge or uncharge NR_WRITEBACK/WB_WRITEBACK by the entire folio size for each request, inflating accounting by up to N× and potentially pushing d...

CVE-2026-72133

CVE-2026-72133 concerns the Linux kernel SPI uniphier driver. The vulnerability arises because devm_request_irq() could be called before init_completion(), allowing an interrupt to occur and the handler to call complete() on an uninitialized completion, causing undefined behavior (observed with K...

CVE-2026-72131

CVE-2026-72131 documents a Linux kernel vulnerability, affecting the nvme-apple driver on Apple A11. The issue is that tags for pending commands must be unique across admin and IO queues; sharing tags can crash the firmware with a message like “duplicate tag error for tag N.” The root cause is th...

CVE-2026-72130

CVE-2026-72130 : In the Linux kernel, the nvmet-auth path is affected. A flaw in nvmet_execute_auth_receive() trusts the host-supplied AUTH_RECEIVE allocation length, allowing a remote NVMe-oF initiator to trigger a 16-byte heap out-of-bounds write by using a one-byte AUTH_RECEIVE allocation leng...

CVE-2026-72128

CVE-2026-72128 affects the Linux kernel nvmet subsystem. In nvmet_sq_create(), a reference on the ctrl is taken via kref_get_unless_zero() before nvmet_check_sqid(). If nvmet_check_sqid() fails, the function returns an error without releasing the reference, causing a refcount leak. The fix jumps ...

CVE-2026-72129

The CVE describes a Linux kernel nvmet-rdma issue: when inline_data_size exceeds PAGE_SIZE, an offset in (PAGE_SIZE, inline_data_size] causes PAGE_SIZE - off to underflow, making sg->length effectively 4 GiB and allowing reading past the first inline page. The root cause is that the mapping as...