kernel

Vulnerabilities (14,027)

• CVE-2026-72421CriAug 15, 2026
  affected >= 3.6.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore error route in local/main tables. When CONFIG_IP_MULTIPLE_TABLES is enabled but no rule is added, fib_lookup() performs route lookup directly on two tables. Since the first lookup does

• CVE-2026-72420HigAug 15, 2026
  affected >= 4.1.0, < 6.12.97fixed 6.12.97

  In the Linux kernel, the following vulnerability has been resolved: md/raid5: avoid R5_Overlap races while breaking stripe batches KCSAN report a race in break_stripe_batch_list() vs. raid5_make_request() on sh->dev[i].flags (plain word write vs. atomic bit op).. and .. one po

• CVE-2026-72419HigAug 15, 2026
  affected >= 6.1.0, < 6.1.178fixed 6.1.178

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() We ran into below KASAN splat, which is mostly uninteresting, beside for having nf_nat_register_fn() in the call chain as a cause for

• CVE-2026-72418HigAug 15, 2026
  affected < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: prevent connlimit drops for early confirmed ct Commit 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add was skipped") introduced a regression where packets for valid conn

• CVE-2026-72417CriAug 15, 2026
  affected >= 6.19.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto() Add sanity check for iph->ihl field in nf_flow_ip4_tunnel_proto() before using it to compute the header size, avoiding out-of-bounds access

• CVE-2026-72416HigAug 15, 2026
  affected >= 3.13.0, < 6.6.145fixed 6.6.145

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_compat: ebtables emulation must reject non-bridge targets xtables targets return netfilter verdicts: NF_ACCEPT, NF_DROP, and so on. ebtables targets return incompatible verdicts: EBT_ACCEPT, EBT

• CVE-2026-72415HigAug 15, 2026
  affected >= 7.0.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Validate written enum value in ge_put_enum_double() ge_put_enum_double() passes the user-supplied enumeration index item[0] to snd_soc_enum_item_to_val() without checking it against the number of it

• CVE-2026-72414Aug 15, 2026
  affected >= 5.7.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: round up PTP perout pin duration pin_duration is converted from the user-provided period to SJA1105 clock ticks and is later passed as the cycle_time argument to future_base_time(). Very sma

• CVE-2026-72413Aug 15, 2026
  affected >= 2.6.12, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: sctp: fix err_chunk memory leaks in INIT handling When sctp_verify_init() encounters unrecognized parameters, it allocates an err_chunk to report them. However, this chunk is leaked in several code paths: 1. I

• CVE-2026-72412CriAug 15, 2026
  affected >= 7.0.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: s390/mm: Fix handling of _PAGE_UNUSED pte bit The _PAGE_UNUSED softbit should not really be lying around. Its sole purpose is to signal to try_to_unmap_one() and try_to_migrate_one() that the page can be discar

• CVE-2026-72411HigAug 15, 2026
  affected >= 7.1.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: fix use-after-free of DSA ports in crc_err_work Upon an MDIO CRC error mxl862xx_crc_err_work_fn() walks the DSA ports and closes the CPU port conduits: dsa_switch_for_each_cpu_port(dp, pri

• CVE-2026-72410HigAug 15, 2026
  affected >= 6.8.0, < 6.12.97fixed 6.12.97

  In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Validate NIX maximum LFs correctly NIX maximum number of LFs can be set via devlink command but that can be done before assigning any LFs to a PF/VF. The condition used to check whether any LFs ar

• CVE-2026-72409HigAug 15, 2026
  affected >= 4.4.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: net: mvneta: re-enable percpu interrupt on resume On Marvell MPIC platforms (Armada 370/XP/38x), mvneta uses a percpu IRQ disable/enable scheme for NAPI: the ISR (mvneta_percpu_isr) calls disable_percpu_irq() t

• CVE-2026-72408CriAug 15, 2026
  affected >= 7.0.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint geneve_gro_receive() reads the GRO hint through geneve_sk_gro_hint_off(), which honours it only when the socket enabled IFLA_GENEVE_GRO_HINT (gs->g

• CVE-2026-72407CriAug 15, 2026
  affected >= 7.0.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in geneve_gro_complete() Even with both paths gated on gs->gro_hint, geneve_gro_complete() re-derives the inner dispatch type and length from the packet and the current gs-

• CVE-2026-72406HigAug 15, 2026
  affected >= 2.6.12, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: net: sungem: fix probe error cleanup gem_init_one() calls gem_remove_one() when register_netdev() fails. gem_remove_one() unregisters and frees resources owned by the net_device, including the DMA block, MMIO m

• CVE-2026-72405HigAug 15, 2026
  affected >= 5.9.0, < 6.12.97fixed 6.12.97

  In the Linux kernel, the following vulnerability has been resolved: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync Yue Sun reported a use-after-free and debugobjects warning in udp_tunnel_nic_device_sync_work() during concurrent device operations. The w

• CVE-2026-72404HigAug 15, 2026
  affected >= 5.3.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() TIPC UDP media bearer teardown calls dst_cache_destroy() on its replicast caches before calling synchronize_net() to wait for concurrent RC

• CVE-2026-72403Aug 15, 2026
  affected >= 6.14.0, < 6.18.40fixed 6.18.40

  In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcp_find_fc_interface() currently selects the first v

• CVE-2026-72402Aug 15, 2026
  affected >= 5.10.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: bpf: Mask pseudo pointer values in verifier logs print_bpf_insn() masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPF_PSEUDO_MAP_FD and B