CVE-2026-72397

The CVE-2026-72397 issue affects Linux kernel hwmon/pmbus: pmbus_data2reg_vid() was hardcoding VR11 encoding regardless of vrm_version, while pmbus_reg2data_vid() respected it. This mismatch could cause incorrect PMBUS_VOUT_COMMAND values for drivers using non-VR11 VID modes, potentially leading ...

CVE-2026-72395

CVE-2026-72395 affects the Linux kernel hwmon: (pmbus) code. A worker that batches regulator events using atomic_or() could pass a combined bitmask to regulator_notifier_call_chain(), and the regulator_handle_critical() switch would fail to match, leaving the reason NULL and bypassing hw_protecti...

CVE-2026-72393

The CVE-2026-72393 issue affects the Linux kernel’s fbnic path for Ethernet devices. The bug arises in fbnic_tx_lso where skb_cow_head() may reallocate the skb and its shared info, causing a use-after-free by tracing a 4-byte read inside a freed skb region. This is a network-attack surface via UD...

CVE-2026-72394

The CVE pertains to the Linux kernel hwmon subsystem, specifically the aspeed-g6-pwm-tach driver. The aspeed_tach_val_to_rpm() function computes fan RPM from the tachometer value without guarding against tach value 0. If tach_div becomes 0, a subsequent do_div() division by zero triggers a kernel...

CVE-2026-72392

The CVE-2026-72392 entry describes a NULL pointer dereference in the Linux kernel during multi-batch inet6_dump_fib/walk logic for IPv6 fib6_dump_table and inet6_dump_fib. The root cause is that inet6_dump_fib() saves progress using a positional index in cb->args[1], which can be invalidated b...

CVE-2026-72391

Summary: CVE-2026-72391 affects the Linux kernel’s SFP MDIO bus handling. The code path in net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy previously leaked the struct mii_bus. The creation path allocates the I2C MDIO bus with mdio_i2c_alloc() (plain non-devm allocation) and registers it, ...

CVE-2026-72390

The CVE-2026-72390 issue is in the Linux kernel net/sched sch_teql implementation. The teql master->slaves singly linked list was not protected against concurrent writes, allowing a slab-use-after-free via teql_master_xmit() while another CPU could hold a stale pointer to the list. The fix add...

CVE-2026-72389

The vulnerability CVE-2026-72389 affects the Linux kernel’s bridge STP implementation. The root cause is a missing IFF_UP check in br_topology_change_detection(), which could allow arming the topology change timer while a bridge is administratively down, potentially causing a use-after-free when ...

CVE-2026-72387

The vulnerability CVE-2026-72387 affects the Linux kernel's DRM panthor path. A potential invalid pointer dereference could occur in group_process_tiler_oom() when heaps is an ERR_PTR(); panthor_heap_pool_put() could dereference that pointer. The fix ensures the pointer is set to NULL in that cas...

CVE-2026-72388

The CVE-2026-72388 entry concerns the Linux kernel DRM/Panthor driver. Root cause: when acquiring the dma_fence lock, drivers can be reached from hardirq context, requiring the IRQ-safe variant and a guard-model switch. Affected component is drm/panthor in the kernel’s fence handling; fix involve...

CVE-2026-72385

CVE-2026-72385 concerns the Linux kernel tracing/fprobe component. The issue is a NULL pointer dereference in fprobe_fgraph_entry() caused by mis-synchronization between two walks that size and fill a shadow-stack reservation under rcu_read_lock(). If a fprobe on an already-live ip becomes visibl...

CVE-2026-72386

The CVE-2026-72386 affects the Linux kernel, in the DRM Panthor component. It describes a leak that occurs when a group is evicted before the tiler_oom_work is serviced; a group reference is tied to the pending tiler_oom_work and must be released if the cancel is effective. The fix ensures the gr...

CVE-2026-72384

CVE-2026-72384 affects the Linux kernel irqchip/ts4800 driver. The vulnerability stems from missing cleanup of a chained interrupt handler installed during probe via irq_set_chained_handler_and_data(); the remove path does not clear this handler, creating a dangling callback that may run after th...

CVE-2026-72383

In the Linux kernel SCTP subsystem, CVE-2026-72383 describes a race in sctp_free_addr_wq() where addr_wq_timer could be re-entered after addr_wq_lock is held, allowing a sctp_addr_wq_timeout_handler() to access freed memory (use-after-free). The vulnerability is mitigated by calling timer_shutdow...

CVE-2026-72382

CVE-2026-72382 affects the Linux kernel ksmbd component. The issue is an unsigned underflow in parse_dacl() when computing the ACE count for a security descriptor, caused by subtracting sizeof(struct smb_acl) from a 16-bit DACL size. This can allow a malformed security descriptor to bypass the AC...

CVE-2026-72381

The CVE covers a Linux kernel use-after-free in ksmbd: fp->owner.name (a per-open kstrdup buffer) can be read while freed during a race between two concurrent SMB2 durable reconnects (DH2C/DHnC) on the same persistent_id. The issue stems from a read in ksmbd_vfs_compare_durable_owner() against...

CVE-2026-72379

The CVE-2026-72379 issue is in the Linux kernel: vfs_tmpfile() did not verify the caller’s fsuid/fsGid mappings, allowing O_TMPFILE creation on idmapped mounts when mapping does not cover the caller. The fix adds a missing fsuidgid_has_mapping() check so that O_TMPFILE creation is blocked unless ...

CVE-2026-72380

Technical details are not publicly available in the provided documents; monitor for updates.

CVE-2026-72378

The CVE-2026-72378 entry concerns the Linux kernel, specifically the afs_extract_vl_addrs() path. The underlying issue is that error codes were only set on the first iteration of a loop; the patch fixes this by ensuring the correct error code is assigned on every iteration. This affects the AFS c...

CVE-2026-72377

Summary of CVE-2026-72377 : In the Linux kernel, a defect in AFS handling caused symlinks and mountpoints to incorrectly inherit AS_RELEASE_ALWAYS due to afs_apply_status(), even though they use afs_dir_aops which have no release_folio callback. This mismatch allowed memory management code to mis...