kernel

Vulnerabilities (14,027)

• CVE-2026-72301HigAug 15, 2026
  affected >= 5.18.0, < 6.1.178fixed 6.1.178

  In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get In sof_ipc3_bytes_put(), the size used for the memcpy is derived from the old data->size already in the buffer, not the incoming new data's size fi

• CVE-2026-72300Aug 15, 2026
  affected < 6.6.145fixed 6.6.145

  In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sof_parse_token_sets() reads array->size while iterating over topology private data. The loop condition only checks that some data remains, so a ma

• CVE-2026-72299CriAug 15, 2026
  affected >= 5.0.0, < 5.10.266fixed 5.10.266

  In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tracepoints tipc_sk_enqueue() runs with sk->sk_lock.slock held while the socket is owned by user context. The spinlock protects the backlog queue in this path, but i

• CVE-2026-72298HigAug 15, 2026
  affected < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() qrtr_endpoint_post() validates an incoming packet with if (!size || len != ALIGN(size, 4) + hdrlen) goto err; where size comes from the wire.

• CVE-2026-72297HigAug 15, 2026
  affected >= 2.6.12, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation Reject ATM traffic classes above ATM_ANYCLASS in check_tp(). SO_ATMQOS stores the supplied QoS after check_qos() succeeds, so accepting larger val

• CVE-2026-72296CriAug 15, 2026
  affected >= 4.6.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETH_HLEN to be pullable in ife_decode() ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes the decapsulated packet to eth_type_trans(),

• CVE-2026-72295HigAug 15, 2026
  affected >= 6.13.0, < 6.18.40fixed 6.18.40

  In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate irqchip index in irqfd routing Sashiko reported that the irqchip index is not validated for LoongArch. Add validation and reject out-of-range irqchip indexes to avoid indexing past the

• CVE-2026-72294HigAug 15, 2026
  affected >= 6.7.0, < 6.12.97fixed 6.12.97

  In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() Function kvm_vcpu_ioctl_interrupt() can be called from userspace, here add irq validility cheking in kvm_vcpu_ioctl_interrupt().

• CVE-2026-72293Aug 15, 2026
  affected >= 7.0.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: Add missing radix_tree_preload() in _gaccess_shadow_fault() Add missing radix_tree_preload() in _gaccess_shadow_fault() to guarantee forward progress. The core of _gaccess_shadow_fault() has be

• CVE-2026-72292Aug 15, 2026
  affected >= 7.0.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Initialize KVM_S390_GET_CMMA_BITS memory kvm_s390_get_cmma_bits() allocates its output buffer with vmalloc(), which does not zero the returned pages: values = vmalloc(args->count); In the non-peek

• CVE-2026-72291CriAug 15, 2026
  affected >= 7.1.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix unlikely race in try_get_locked_pte() Fix an unlikely race in try_get_locked_pte(), which could have happened if puds or pmds get unmapped between the p?dp_get() and p?d_offset() functions.

• CVE-2026-72290Aug 15, 2026
  affected >= 6.0.0, < 6.1.178fixed 6.1.178

  In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix GISC refcount leak on AIF enable failure kvm_s390_gisc_register() registers the guest ISC before pinning the guest interrupt forwarding pages and allocating the AISB bit. If any of the later

• CVE-2026-72289CriAug 15, 2026
  affected >= 4.7.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating it vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating an interrupt to another vCPU. After reacquiring the locks it onl

• CVE-2026-72288CriAug 15, 2026
  affected >= 4.8.0, < 6.18.40fixed 6.18.40

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling Hyunwoo Kim reports some really bad races should the following situation occur: - LPI-I is pending in vcpu-B's AP list - vcpu-A

• CVE-2026-72287HigAug 15, 2026
  affected >= 6.19.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks Move the off-by-default consistency check for vmcs12.tpr_threshold vs. the virtual APIC vTPR into the "normal" controls checks, as w

• CVE-2026-72286HigAug 15, 2026
  affected >= 6.11.0, < 6.12.97fixed 6.12.97

  In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs The intra-host migration/mirroring feature is not fully implemented for SEV-SNP VMs. The proper migration requires additional SNP-specific state

• CVE-2026-72285HigAug 15, 2026
  affected >= 6.19.0, < 7.1.5fixed 7.1.5

  In the Linux kernel, the following vulnerability has been resolved: KVM: TDX: Reject concurrent change to CPUID entry count Reject KVM_TDX_INIT_VM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data. tdx_td_init() first r

• CVE-2026-72284HigAug 15, 2026
  affected >= 3.6.0, < 6.1.178fixed 6.1.178

  In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs Ignore KVM's internal "service pending PV EOI" request if the vCPU has disabled PV EOIs since the request was made. Asserting that PV EOIs

• CVE-2026-72283HigAug 15, 2026
  affected >= 6.17.0, < 6.18.40fixed 6.18.40

  In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails Nullify irqfd->producer if updating the IRTE for bypass fails, as leaving a dangling pointer will result in a use-after-free if the irqfd is r

• CVE-2026-72282HigAug 15, 2026
  affected >= 4.8.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers kvm_io_bus_get_dev() returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched dev