CVE-2026-72285

CVE-2026-72285 – Linux kernel KVM/TDX CPUID count race : The vulnerability occurs when userspace can change cpuid.nent between the initial read and the allocation of the kvm_tdx_init_vm copy, causing a mismatch in the number of CPUID entries that are copied and later processed. The fix enforces t...

CVE-2026-72284

CVE-2026-72284 affects the Linux kernel KVM on x86, where a logic error in arch/x86/kvm/lapic.c (line ~3338) caused PV EOIs to be ignored if the vCPU later disables PV EOIs, potentially triggering a kernel oops (invalid opcode) during KVM vCPU ioctls. The vulnerability is locally exploitable as p...

CVE-2026-72283

CVE-2026-72283 concerns the Linux kernel's KVM/x86 path. The issue: when updating the IRTE for bypass fails, irqfd->producer is not cleared, creating a potential use-after-free if the irqfd is reachable via KVM routing while the producer is freed separately (e.g., VFIO PCI, where the producer ...

CVE-2026-72282

The CVE-2026-72282 entry concerns the Linux kernel KVM path: kvm_io_bus_get_dev() now requires the caller to hold the srcu lock, moving locking responsibilities to the caller. The function returns a device matched only by address, which can lead to a lifetime issue if the device’s type isn’t as e...

CVE-2026-72281

The CVE-2026-72281 entry concerns the Linux kernel KVM arm64/pKVM reclaim against the VM memory manager. The issue arose because protected guest faults could pin long-term resources to the VM’s mm (memory descriptor), and teardown could execute later from file release with current->mm potentia...

CVE-2026-72280

CVE-2026-72280 concerns the Linux kernel KVM on arm64. The vulnerability arises from a logic issue where a guest could write to the ZCR_EL2 sysreg alias in a nested context if FEAT_NV2 is advertised to the L1 hypervisor. The fix is to drop the bogus WARN that could lead to a hyp_panic once hyp ve...

CVE-2026-72279

The CVE-2026-72279 entry concerns the Linux kernel KVM arm64 implementation for the L1 VNCR mapping. The fix ensures that the host stage-1 mapping respects the read-only status of the guest PFN by caching PFN writability in the VNCR TLB and using this to constrain fixmap permissions. If a guest t...

CVE-2026-72278

In CVE-2026-72278, the Linux kernel KVM for arm64 mitigates a VNCR abort handling issue by invalidating the VNCR TLB and re-fetching the translation when a VNCR abort occurs. This allows the host mapping to be faulted in for write on the second attempt, addressing a scenario where a guest could r...

CVE-2026-72277

Summary (CVE-2026-72277): In the Linux kernel’s KVM for arm64, the L1 VNCR mapping logic now rejects non-memory PFNs when constructing VNCR mappings, due to unconditional use of cacheable memory attributes that could trigger an SError on writeback. The vulnerability affected KVM’s handling of VNC...

CVE-2026-72276

CVE-2026-72276 concerns the Linux kernel fbdev/metronomefb subsystem. The issue is a memory leak where pagerefs allocated in fb_deferred_io_init() are not freed on error paths during metronomefb_probe(), leading to leaked resources. The documented fix is to call fb_deferred_io_cleanup() on error ...

CVE-2026-72275

The CVE concerns the Linux kernel fbdev driver for broadsheetfb. A memory leak was introduced where pagerefs allocated in fb_deferred_io_init() were not freed on error paths in broadsheetfb_probe(). The issue is fixed by invoking fb_deferred_io_cleanup() to release the allocated resources. The do...

CVE-2026-72274

The CVE-2026-72274 entry concerns the Linux kernel fbdev driver, specifically the hecubafbProbe path. A memory leak was introduced where the pagerefs allocated in fb_deferred_io_init() were not freed on the error path. The issue is resolved by calling fb_deferred_io_cleanup() to release those res...

CVE-2026-72273

The CVE-2026-72273 entry corresponds to a Linux kernel issue in fbdev/efifb where a string returned by fb_get_options() was not freed in efifb_probe(), causing a memory leak. The root cause follows the 73ce73c30ba9 commit that clarified ownership and transfer of video option strings; the fix is t...

CVE-2026-72272

The CVE-2026-72272 entry concerns the Linux kernel’s fbdev: radeon component. It describes a memory-leak in radeonfb_pci_register() where modelist memory allocated by radeon_check_modes()/fb_add_videomode() is appended to info->modelist but not freed on error paths, with the fix implemented by...

CVE-2026-72271

The CVE pertains to Linux kernel fbdev/i740fb: a memory leak in i740fb_probe where memory allocated by fb_videomode_to_modelist() for modelist was not freed in error paths. The issue is resolved by calling fb_destroy_modelist() to free the allocated modelist in all error paths. Affected component...

CVE-2026-72270

The connected documents confirm a concrete issue in the Linux kernel’s fbdev/s3fb driver: in s3_pci_probe(), memory allocated for modelist via fb_videomode_to_modelist() was not freed on error paths, causing a potential memory leak. The remediation is to free this resource by calling fb_destroy_m...

CVE-2026-72269

In the Linux kernel, the fbdev driver uvesafb had a memory-leak in the probe path: memory allocated for modedb and modelist in uvesafb_vbe_init() could be leaked on some error paths due to an incorrect goto label. The issue is resolved by updating the goto label in the error handling. This affect...

CVE-2026-72268

The CVE-2026-72268 entry concerns the Linux kernel fbdev driver tdfxfb. In tdfxfb_probe, memory is allocated for a modelist via fb_videomode_to_modelist() when CONFIG_FB_3DFX_I2C is defined, but this memory is not freed along error paths. The fix is to call fb_destroy_modelist() to release the al...

CVE-2026-72266

The CVE-2026-72266 entry concerns a memory-leak in the Linux kernel’s vesafb path under fbdev. The root cause is that a string returned by fb_get_options() was not freed by vesafb_probe() after setup, despite an earlier change that the caller should free the string. The issue has been resolved by...

CVE-2026-72267

CVE-2026-72267 affects the Linux kernel fbdev CarmineFB component. The issue is a memory leak: modelist allocated in fb_videomode_to_modelist() is not freed on error paths, addressed by calling fb_destroy_modelist(). Connected sources confirm the exact fix and function sequence across multiple ke...