CVE-2026-72157

The CVE-2026-72157 fix in the Linux kernel narrows the allowed ThunderboltIP packet frame count to prevent skb frags overflow. tbnet_poll() assembles multi-frame packets into one skb with fragments; if a peer sends more than MAX_SKB_FRAGS frames, skb_add_rx_frag() wrote past frags[] and corrupted...

CVE-2026-72156

CVE-2026-72156 : In the Linux kernel, the vulnerability affects the fpga: microchip-spi path in mpf_ops_parse_header(), where header_size is read from the bitstream at MPF_HEADER_SIZE_OFFSET (24). If header_size is zero, the code evaluates *(buf + header_size - 1), which dereferences before the b...

CVE-2026-72155

CVE-2026-72155 concerns the Linux kernel driver mtd: spi-nor: swp, where unlocking the first- or early-blocks can fail when attempting to unlock only currently locked blocks. The root cause is that when both sides can achieve the same result (unlock everything), the lock_len logic misbehaved beca...

CVE-2026-72154

CVE-2026-72154 describes a Linux kernel vulnerability in the OpenRISC path related to jump_label SMP cache syncing. The issue arose from an OpenRISC-specific implementation that copied from arm64 and didn’t correctly handle icache invalidation on remote cores, which could leave stale static_key c...

CVE-2026-72153

In the Linux kernel, the irqchip/crossbar code path crossbar_domain_free() incorrectly used the nulled irq_data->hwirq as an index to clear irq_map[] and to update the crossbar register, which meant the wrong index could be freed and the crossbar connection to the source interrupt could remain...

CVE-2026-72152

CVE-2026-72152 concerns the Linux kernel component related to TPM SPI handling (tpm_tis_spi) and the wait-for-status flow used in wait_for_tmp_stat(). The issue arises from how wait_event_interruptible_timeout() evaluates its condition after setting the task state to TASK_INTERRUPTIBLE, which can...

CVE-2026-72151

CVE-2026-72151 — Linux kernel : The tpm2-sessions path (tpm_buf_append_salt in drivers/char/tpm/tpm2-sessions.c) calls crypto_kpp_generate_public_key() and crypto_kpp_compute_shared_secret() without a completion callback, discards both return values, and immediately frees the kpp_request. For asy...

CVE-2026-72150

The CVE-2026-72150 issue affects the Linux kernel sunrpc subsystem. The xprt_create_args structure was allocated on the stack without initialization in rpc_sysfs_xprt_switch_add_xprt_store(), leaving fields such as srcaddr, bc_xps, and flags with garbage data. This can cause kernel panic when xs_...

CVE-2026-72149

The CVE-2026-72149 entries describe a Linux kernel vulnerability in the Tegra GPC DMA engine where transfer lengths not divisible by the configured max burst size cause a hang due to partial bursts. The root cause is a burst size calculation that assumed lengths would align with the max burst, wh...

CVE-2026-72147

The CVE-2026-72147 issue affects the Linux kernel’s dmaengine dw-edma-pcie driver. In dw_edma_pcie_probe, the PCI device ID driver_data is treated as the controller layout template and copied unconditionally. A device bound dynamically via sysfs can match the driver without that data, leading to ...

CVE-2026-72148

The CVE-2026-72148 vulnerability affects the Linux kernel’s dmaengine dw-edma driver. The DONE_INT_MASK and ABORT_INT_MASK registers are shared across DMA channels and are updated via non-atomic read-modify-write sequences, enabling race conditions when two channels update them concurrently. Miti...

CVE-2026-72146

CVE-2026-72146 concerns the Linux kernel dmaengine rz-dmac issue. In the fix, the interrupt request is moved to occur after full setup, preventing the IRQ handler from accessing channel->ch_base before initialization and the IRQ thread from touching uninitialized data (ld_free, ld_queue, ld_ac...

CVE-2026-72145

The documents confirm CVE-2026-72145 affects Linux kernel code in platform/x86/intel/tpmi. The mem_write() path now uses cleanup.h scope-based cleanup to automatically free a temporary array returned by parse_int_array_user(), ensuring release on all exit paths. The array declaration was moved ne...

CVE-2026-72143

CVE-2026-72143 (Linux kernel, platform/x86 ISST): Affected code path restores SST-PP control to all domains after resume. The bug is that the SST-PP control offset is restored incorrectly (only to power domain 0 after resume) while suspend stores control values for all domains. The fix changes us...

CVE-2026-72144

Summary (CVE-2026-72144) In the Linux kernel, the Dell X Dell-laptop platform had an init error path cleanup issue in dell_init(): if a later LED or backlight registration failed, not all resources were torn down. Specifically, after dell_setup_rfkill(), resources such as the notifier, debugfs di...

CVE-2026-72142

CVE-2026-72142 affects the Linux kernel i2c/imx driver, fixing a locked bus on SMBus block-read of 0 (atomic). The vulnerability occurs when SMBus 3.1 6.5.7 allows a Block Read byte count of 0 but the atomic path rejects it (-EPROTO) and can start a new receive cycle, leaving SDA held and the bus...

CVE-2026-72141

CVE-2026-72141 covers a Linux kernel issue in the i2c/imx SMBus path where a Block Read with a count of 0 could cause the bus to stay locked. The vulnerability arises because the interrupt-driven state machine incorrectly handles -EPROTO for a zero-byte block read, failing to issue a NACK+STOP an...

CVE-2026-72140

CVE-2026-72140 relates to the Linux kernel, specifically the i2c mlxbf subsystem. The vulnerability arises in mlxbf_i2c_init_resource() when devm_platform_get_and_ioremap_resource() returns an error: tmp_res is freed before tmp_res->io is read to obtain the error code, causing a use-after-free...

CVE-2026-72139

The CVE concerns a Linux kernel race where per-socket authentication data (md5sig/md5sig_key) could be freed before an RCU grace period elapses during tcp_connect. In the vulnerable path, two branches (needs_md5 and needs_ao) free the md5sig_info or its keys while a socket is in TCP_SYN_SENT, ris...

CVE-2026-72138

The CVE describes a Linux kernel issue in xen/gntdev where gntdev_ioctl_map_grant_ref() could leak memory if copy_to_user() failed after adding a mapping and not releasing the acquired reference. The root cause involves mismanaged error paths: on failure to copy operation results back to userspac...