CVE-2026-72475

The CVE-2026-72475 impact is in the Linux kernel DMA engine, specifically the dma-axi-dmac path. The issue arises from mismanagement of descriptors: a struct axi_dmac_desc is not fully freed along the failure path in axi_dmac_prep_peripheral_dma_vec() when calling axi_dmac_alloc_desc(). The mitig...

CVE-2026-72474

Summary (concrete details available) : CVE-2026-72474 concerns the Linux kernel’s dmaengine, specifically the dma-axi-dmac path. The issue arises on architectures such as Microblaze or arm64 where DMA_DIRECT_REMAP can cause dma_alloc_coherent() to remap memory (including vmalloc()). In the affect...

CVE-2026-72473

Affected software: Linux kernel (xprtrdma RPC path). Vulnerability: a race/lifecycle issue in rl_kref and send-side references within rpcrdma/xprt_rdma code caused improper freeing of request buffers while a DMA operation could still be active. Root cause: rl_kref previously gated two lifetimes w...

CVE-2026-72472

CVE-2026-72472 – Linux kernel NFS file lock traversal protection fix . The issue arises in the NFS portion of the Linux kernel where releasing flc_lock during file lock list traversal could trigger use-after-free (UAF). The mitigation switches to protecting the traversal with nfsi->rwsem, appl...

CVE-2026-72471

CVE-2026-72471: In the Linux kernel (ntfs3) vulnerability, a path where target VCN isn’t found could lead run_lookup() to false, causing a chain that results in attr_data_get_block() receiving a NULL and finally exit without initializing lcn. The fix prevents this by moving the clen check in ni_s...

CVE-2026-72470

The CVE-2026-72470 vulnerability affects the Linux kernel fs/ntfs3 sub-system. log_replay() initially allocates log->one_page_buf using the host’s PAGE_SIZE, but when an on-disk restart area specifies a larger page size, log->page_size is updated, while one_page_buf may remain undersized. S...

CVE-2026-72468

Summary: CVE-2026-72468 affects the Linux kernel components xprtrdma/rpcrdma. A race between NFS/RDMA mount and RDMA device removal could trigger a NULL dereference in the kernel trace path. Affected context (from provided docs): rpcrdma_ep_create() and rpcrdma_create_id() interactions allow the ...

CVE-2026-72469

CVE-2026-72469 affects the Linux kernel’s xprtrdma/rpcrdma path, where an ADDR_CHANGE event can cause an ep kref underflow because rpcrdma_ep_put() would run without a matching rpcrdma_ep_get() when ESTABLISHED hasn’t occurred yet. The documents describe the lifecycle sequence, showing a mismatch...

CVE-2026-72467

CVE-2026-72467 (Linux kernel, xprtrdma) : The vulnerability arises when frwr_wp_create() fails during connect and rpcrdma_xprt_connect() ignores the error, causing xprt_rdma_connect_worker() to incorrectly report success and set XPRT_CONNECTED. A subsequent NFS/RDMA read with a non‑4‑byte‑aligned...

CVE-2026-72466

Summary of CVE-2026-72466 : In the Linux kernel’s xprtrdma implementation, two path issues in rpcrdma_is_bcall() can leak the receive buffer and drain the Receive queue when decoding a reply. The speculative zero-byte peek uses xdr_inline_decode() without respecting xdr->end, allowing five sub...

CVE-2026-72464

In the Linux kernel, CVE-2026-72464 relates to xprtrdma: Repost Receive buffers for malformed replies. rpcrdma_wc_receive() decrements the transport’s Receive count for every completion and rpcrdma_reply_handler() must post a replacement Receive WR before returning, or ownership of the rep is mov...

CVE-2026-72465

The CVE-2026-72465 issue affects the Linux kernel’s xprtrdma handling. The vulnerability arises when a well-formed reply carrying an inflated credit grant bypasses the credit clamp due to an early exit, allowing the reply to drive receive postings past re_max_requests. The fix moves the credit-cl...

CVE-2026-72463

CVE-2026-72463 (Linux kernel xfrm): The flaw lets a use-after-free occur in xfrm async resumption when xfrm_rcv_cb changes skb->dev to a tunnel device without taking a reference, risking tunnel dev UAF and orig device refcount leaks. The patch stashs the original skb->dev and extends RCU pr...

CVE-2026-72461

Vulnerability CVE-2026-72461 affects the Linux kernel with AppArmor: a refcount leak in updating the sk_ctx. Root cause: update_sk_ctx() transfers the plabel reference but also unconditionally releases it in the caller; the fix is to obtain a proper reference and avoid double-free. Affected compo...

CVE-2026-72462

The CVE-2026-72462 entries describe a race in AppArmor unix socket mediation on Linux kernels where holding a reference to peer_sk is insufficient to guarantee access to the peer path. The race occurs when accessing the peer path outside the state lock, potentially conflicting with unix_release_s...

CVE-2026-72460

CVE-2026-72460 affects the Linux kernel’s AppArmor path: aa_change_profile() builds a replacement label with fn_label_build_in_scope() before the no_new_privs subset check, and the build helper may return NULL/ERR_PTR, with the result previously passed to aa_label_is_unconfined_subset() without I...

CVE-2026-72459

CVE-2026-72459 concerns the Linux kernel AppArmor path: in aa_label_alloc(), a secid is allocated before creating the label proxy. If the subsequent proxy step fails, the error path currently frees only the label memory, leaking resources initialized by aa_label_init(). The fix is to call aa_labe...

CVE-2026-72458

Summary: CVE-2026-72458 affects the Linux kernel (apparmor module) and is due to a NULL pointer dereference in unpack_pdb when pdb->dfa can be NULL if unpack_dfa fails. This could lead to a dereference vulnerability in apparmor paths. What’s affected: Linux kernel components implementing appar...

CVE-2026-72457

In the Linux kernel, the AppArmor vulnerability arises during policy unpack when an ACCEPT2 table allocation fails. The function unpack_pdb() may need to allocate a missing ACCEPT2 table for older policy data; if the allocation fails, an error is set but execution continues to the success path, r...

CVE-2026-72456

CVE-2026-72456 affects the Linux kernel's apparmor path handling. The vulnerability arises in get_current_exe_path(), which takes both an exe_file reference and a path reference before resolving the path name. If aa_path_name() fails, the function could return early and leak both references. The ...