A vulnerability in the Linux kernel RDMA core related to FRMR aging push to queue error flow has been fixed. The issue involved improper handling of failures when moving handles from the active queue to a non-empty inactive queue during aging pools with pinned handles, which could lead to leaking memory keys (mkeys). The fix introduces a helper function that safely moves pages between queues without allocation failures, simplifying error handling and preventing leaks.
A resource leak vulnerability in the Linux kernel's RDMA core was fixed by ensuring destruction of FRMR handles when the push to the pool fails. This prevents resource leaks caused by failed pool page allocations.
A high-severity vulnerability in the Linux kernel's network subsystem involves improper ordering during the teardown of leased receive queues (rxq). The issue arises because the memory provider's DMA mappings are revoked before stopping the physical RX queue, allowing the device to potentially DMA to stale or zero addresses. This flaw has been fixed by changing the order to stop the queue before uninstalling the memory provider, preventing use-after-free conditions.
A high-severity vulnerability in the Linux kernel's rtl8723bs staging driver was fixed by correcting a null-pointer check in the rtw_aes_decrypt function. The original check incorrectly returned failure on valid pointers, which was inverted to properly return failure only on invalid pointers. This flaw affected multiple specific Linux kernel versions.
CVE-2026-72465 is a vulnerability in the Linux kernel's xprtrdma component where the reply credit grant is not properly sanitized after parsing. This flaw allows a peer to send a reply with an unknown transaction ID (XID) and an inflated credit grant, causing the system to allocate and post receive work requests beyond the configured maximum. The issue was fixed by moving the credit clamp to immediately after parsing the credit field, ensuring all subsequent consumers see a sanitized value.
A vulnerability in the Linux kernel's tpm_crb driver was fixed by adding a check for a NULL ACPI companion object during device probing. Without this check, platform drivers relying on the ACPI companion object could be forced to match devices incorrectly due to device_match_driver_override(), potentially causing improper behavior. The issue affects specific versions of the linux-hwe-edge kernel and has been resolved by verifying the presence of the ACPI companion object before use.
CVE-2026-72411 is a use-after-free vulnerability in the Linux kernel's DSA driver for mxl862xx devices. It occurs when a CRC error triggers a delayed work function that accesses freed DSA port objects during switch teardown. The flaw is fixed by guarding the port access with a flag checked under rtnl_lock(), preventing use-after-free conditions.
A null pointer dereference (NPD) vulnerability exists in the Linux kernel's drm/xe component in the bo_meminfo() function. This occurs when a buffer object (BO) is purged and its ttm.resource is set to NULL, but the BO remains in the client's object list until userspace closes the GEM handle. Querying memory stats during this time leads to dereferencing a NULL pointer, causing potential crashes or instability. The issue has been fixed by adding checks to safely skip purged BOs in bo_meminfo().
CVE-2026-72358 is a vulnerability in the Linux kernel's drm/xe/pt driver that allows invalid cursor access for purged buffer objects (BOs). The flaw occurs because certain functions did not check if a BO was purged before accessing an uninitialized cursor, leading to warnings and potential memory access issues. The issue has been fixed by adding explicit checks and zero-initializing the cursor to prevent invalid accesses.
CVE-2026-72354 is a high-severity vulnerability in the Linux kernel's NTFS driver related to stale runlist element dereference during Master File Table (MFT) writeback. The flaw occurs when a runlist element pointer is used after its backing memory has been freed due to concurrent MFT allocation extension, leading to a use-after-free condition. This can cause kernel crashes or potentially allow an attacker with local privileges to execute arbitrary code or cause denial of service. The issue affects specific Linux kernel versions listed and has been resolved by changing the code to compute necessary values while holding the lock, avoiding use of freed memory. No known exploits are reported in the wild.
A NULL pointer dereference vulnerability exists in the Linux kernel's bitland-mifs-wmi driver during suspend/resume operations. The event device path does not initialize a required pointer, leading to a kernel Oops and suspend failure. The issue is fixed by adding validity checks to skip operations when the pointer is NULL.
A vulnerability in the Linux kernel's drm/xe component causes a memory leak due to improper cleanup of a madvise VMA array on L2 flush failure. Specifically, error handling after allocation of madvise_range.vmas does not free the allocated array in some failure paths, leading to a resource leak during ioctl calls.
A memory leak vulnerability in the Linux kernel's tracing/remotes subsystem was fixed. The issue occurred in the trace_remote_alloc_buffer() function when page allocation failed, causing incomplete cleanup of partially allocated buffers. This was due to the desc->nr_cpus counter not being incremented before the failure, preventing proper freeing of resources in the error path.
A critical race condition vulnerability in the Linux kernel's KVM s390 code was fixed. The flaw involved an unlikely race in the try_get_locked_pte() function, where page table entries could be unmapped between specific internal calls, potentially leading to severe impact on confidentiality, integrity, and availability.
CVE-2026-72281 is a medium severity vulnerability in the Linux kernel affecting KVM on arm64 architectures. It involves improper accounting of pKVM reclaim operations against the VM's memory management (mm), where protected guest faults incorrectly charge long-term pins to the VM's mm. This can lead to teardown operations running later with an unrelated current->mm, potentially causing resource mismanagement. The issue has been resolved by dropping the charge from kvm->mm instead.
CVE-2026-72211 is a critical vulnerability in the Linux kernel's NTFS implementation related to incorrect resizing of the resident index root value during the ntfs_ir_reparent() operation. The flaw occurs when the code updates the index root header to a larger size before successfully resizing the resident value, potentially causing transient corruption that leads to lookup failures and reported index root corruption. This can result in denial of service or data integrity issues. The vulnerability affects multiple specific Linux kernel versions.
CVE-2026-72210 is a critical vulnerability in the Linux kernel's NTFS driver caused by an off-by-one error in the bounds checking of mapping pairs decoding. The flaw allows a one-byte out-of-bounds read when processing NTFS attribute records due to improper use of strict greater-than checks instead of greater-than-or-equal. This can lead to potential memory corruption with high impact on confidentiality, integrity, and availability.
CVE-2026-72209 is a critical vulnerability in the Linux kernel's NTFS implementation where improper validation of variable-length resident attribute values can lead to out-of-bounds reads. A crafted NTFS image can exploit this flaw by setting inconsistent length fields in the $FILE_NAME attribute, causing kernel functions to read beyond allocated memory. This issue was addressed by adding a shared attribute value validator that enforces proper bounds checking and rejects invalid non-resident $FILE_NAME records.
A critical vulnerability (CVE-2026-72208) in the Linux kernel's NTFS implementation was fixed by adding bounds checks before accessing Extended Attribute (EA) entries in the ntfs_ea_lookup and ntfs_listxattr functions. This fix ensures that there is sufficient space in the EA entry before accessing the next_entry_offset field, preventing out-of-bounds memory access.
A critical vulnerability in the Linux kernel's NTFS implementation involves improper handling of zero-byte $DATA attributes. The function ntfs_resident_attr_resize() incorrectly attempts to convert zero-length resident $DATA attributes to non-resident, which leads to file system corruption as fsck treats these as corruptions.