These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Linux kernel vulnerability, CVE-2026-72139, involves a use-after-free issue in the TCP implementation. The bug arises from the tcp_connect function's handling of md5sig_info objects, leading to a race condition between softirq readers and the process context. This vulnerability affects Linux kernel users and administrators, who should be aware and take steps to mitigate it. The CVE record was publishe [truncated]
The Linux kernel vulnerability CVE-2026-72138 was resolved by fixing error handling in the ioctl function. The fix involves holding a mutex across gntdev_add_map(), retrieving the correct index, and copy_to_user(). If copy_to_user() fails, the mapping is removed from the list and the reference is released while still holding the lock. This fix prevents potential memory leaks and dangling list entries. Lin [truncated]
A vulnerability in the Linux kernel's xfrm nat_keepalive component has been resolved, related to double-free issues. This issue arises when the IPv4 or IPv6 send helper reports an error, and the keepalive skb is freed. However, if the skb is already handed to the output path, the networking stack may have consumed it before returning an error, leading to a double-free. Affected product context includes Li [truncated]
The Linux kernel has a vulnerability that has been resolved. The xfrm: xfrm_interface requires CAP_NET_ADMIN in the device netns for changelink. The xfrmi_changelink operates on at most two netns, dev_net(dev) and the interface link netns xi->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against [truncated]
The Linux kernel vulnerability CVE-2026-72135 allows for an out-of-bounds heap read and write through the TPM character devices. The vulnerability arises from the devices' open handlers leaving FMODE_PREAD and FMODE_PWRITE enabled, enabling sequential command/response interfaces. A large offset in pread() can cause an out-of-bounds read and write. The issue is resolved by calling nonseekable_open() from b [truncated]
The Linux kernel has a vulnerability in the spi: imx driver. When DMA cannot be started, the ECSPI is not properly reconfigured for PIO mode, leading to corrupted data. This issue can be triggered on i.MX8MP boards with ECSPI DMA described in the device tree but running SDMA on ROM firmware. The vulnerability exists due to improper handling of DMA descriptor preparation failure, causing the driver to fall [truncated]
A vulnerability in the Linux kernel's spi: uniphier driver has been resolved. The driver called devm_request_irq() before initializing the completion used by the interrupt handler, which could result in undefined behavior. The completion is now initialized before registering the IRQ. This change prevents potential crashes or security issues by ensuring that the interrupt handler's completion is properly s [truncated]
The Linux kernel vulnerability, CVE-2026-72132, involves incorrect writeback accounting for unstable NFS writes. This issue arises from the nfs_folio_mark_unstable() and nfs_folio_clear_commit() functions charging and uncharging NR_WRITEBACK/WB_WRITEBACK by folio_nr_pages(folio) once per request added to or removed from a commit list. The problem is that this approach is correct only when a folio has a si [truncated]
The Linux kernel vulnerability, CVE-2026-72130, allows a remote NVMe-oF initiator to trigger a 16-byte heap out-of-bounds write via a one-byte AUTH_RECEIVE allocation length. This issue affects Linux kernel-based systems using NVMe-oF authentication. The vulnerability arises from nvmet_execute_auth_receive() trusting the AUTH_RECEIVE allocation length after checking only that it is nonzero and matches the [truncated]
The Linux kernel has a vulnerability in the nvmet-rdma component that has been resolved. The issue arises from improper handling of inline data with a nonzero offset, leading to potential out-of-bounds reads. This vulnerability exists in the nvmet-rdma component of the Linux kernel, related to handling inline data with a nonzero offset. The issue has been resolved through a series of commits that correctl [truncated]
A vulnerability in the Linux kernel has been resolved, related to the reporting of NAPI thread PID in the caller's pid namespace. The netdev-genl family reports NAPI thread PID in the caller's pid namespace, allowing a caller in a child pid namespace to issue NETDEV_CMD_NAPI_GET and see the kthread's global PID, even though the kthread is not visible in its pid namespace. This issue can impact Linux kerne [truncated]
The Linux kernel has a use-after-free vulnerability in the CAN isotp subsystem. The vulnerability is caused by isotp_release() not waiting for a grace period before cancelling the RX timer, allowing an in-flight isotp_rcv() to re-arm the timer after the socket has been freed. This can lead to a use-after-free timer callback on the freed socket. The fix ensures that the RX timer is cancelled after a grace [truncated]
A use-after-free race condition vulnerability was found in the Linux kernel's CAN isotp implementation. The vulnerability occurs when a concurrent NETDEV_UNREGISTER event is processed while isotp_release() is executing, leading to a potential use-after-free error. This vulnerability impacts Linux kernel developers and maintainers, CAN isotp users and implementers, operators of Linux-based systems, securit [truncated]
A vulnerability in the Linux kernel's CAN isotp has been resolved. The TX state machine was driven from multiple contexts, leading to potential corruption of unrelated transfers. The fix involves serializing TX state transitions under the so->rx_lock. This change ensures that the TX state machine is updated consistently, preventing corruption of unrelated transfers. Linux kernel developers and maintainers [truncated]
A vulnerability in the Linux kernel's CAN (Controller Area Network) subsystem has been resolved. The issue was related to a race condition in the bcm (Broadcast Manager) protocol, which could lead to a socket bound to a specific CAN interface being silently turned into one that matches 'any' interface. This could result in unexpected behavior and potential security issues.
The Linux kernel's CAN bcm implementation had a vulnerability where improper synchronization could allow for use-after-free attacks. An update has been provided to extend bcm_tx_lock usage for data and timer updates, addressing the issue. This update stages new CAN frame content for an existing tx op into a kmalloc()'d buffer and validates it there, mirroring the approach already used in bcm_rx_setup(). O [truncated]
The Linux kernel vulnerability CVE-2026-72118 is caused by a data race within the bcm_rx_handler() when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. This issue can lead to inaccurate CAN frame rx/tx statistics. The vulnerability was resolved by using atomic operations with (signed) long data types to access the statistics in the hot path. Addition [truncated]
The Linux kernel has a vulnerability, CVE-2026-72115, related to CAN bcm tracking a single source interface for ANYDEV timeout/throttle operations. This issue arises when an ANYDEV rx op with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces, potentially causing spurious RX_TIMEOUT notifications and last_frames corruption. Affected syst [truncated]
The Linux kernel vulnerability, CVE-2026-72113, involves a missing device refcount for CAN filter removal in the bcm.c code. This issue can lead to a stale CAN filter pointing at the soon-to-be-freed bcm_op/socket if a concurrent NETDEV_UNREGISTER has already unlisted the device from the ifindex table. A former fix for raw.c introduced a netdevice_tracker which solves the issue for bcm.c too. Linux kernel [truncated]
A use-after-free vulnerability was found in the Linux kernel's io_uring subsystem when re-registering an already-bound BPF operations struct. This issue allows a local attacker with CAP_BPF and CAP_PERFMON to potentially escalate privileges. The vulnerability arises from the fact that io_install_bpf() only rejects a second registration on the ctx side and sets the per-map back-pointer ops->priv unconditio [truncated]
The Linux kernel has a vulnerability in the BPF verifier that could lead to a verifier/runtime mismatch, allowing an attacker to bypass BPF memory safety checks. This issue has been resolved by resetting register bounds before narrowing the retval range in check_mem_access(). The vulnerability exists in the Linux kernel's BPF verifier, which is used to verify the safety of BPF programs. The verifier proce [truncated]
A vulnerability has been resolved in the Linux kernel related to the sparx5 net device driver. The sparx5_register_notifier_blocks() function registers a switchdev blocking notifier before allocating an ordered workqueue. If the workqueue allocation fails, the error path unregisters the switchdev and netdevice notifiers but leaves the blocking notifier registered. This issue has been addressed by adding a [truncated]
The Linux kernel vulnerability CVE-2026-72108 affects the dm thin metadata component. Affected products include Linux kernel deployments utilizing dm thin metadata. The vulnerability class is related to inconsistent metadata due to improper handling of held_root updates during commit failures. Likely operational impact includes potential data inconsistencies or loss in certain failure scenarios. Source-co [truncated]
The Linux kernel's dm era module has a vulnerability that allows for out-of-bounds memory access when the start sector is non-zero. This can lead to a vmalloc-out-of-bounds access error as reported by KASAN. The issue arises from the era_map() function calculating the writeset block before applying the target offset, which can cause the function to access memory beyond the bounds of the in-core bitset. To [truncated]
A vulnerability was found in the Linux kernel's dm-log component. The issue arises from a bitset_size overflow on 32-bit machines. Specifically, the region_count variable, which is used to calculate bitset_size, can overflow when rounded up to a multiple of BITS_PER_LONG, leading to a wrap-around to 0 on 32-bit architectures. This can cause memory allocation issues despite region_count being valid.
The Linux kernel vulnerability CVE-2026-72104 is related to the dm-pcache target. A table that advertises one optional argument and supplies only a recognized option name, for example 'cache_mode', reaches parse_cache_opts() with argc == 1. The parser consumes the name, decrements argc to zero, then calls dm_shift_arg() again for the value. dm_shift_arg() returns NULL when no arguments remain, and the fol [truncated]
The Linux kernel's dm (device-mapper) module has a vulnerability (CVE-2026-72103) that causes the caller's thread keyring to persist, leading to a leaked copy of the LUKS volume key. This can result in the key being recoverable from RAM after a suspend operation intended to wipe it. The issue arises from a refactoring commit (a28d893eb327) in the Linux kernel's dm (device-mapper) module, which inadvertent [truncated]
The Linux kernel has a vulnerability that has been resolved. If dm_resume fails, the kernel attempts to free a table with dm_table_destroy, but the table was already instantiated with dm_swap_table. This commit skips the call to dm_table_destroy in this case. The vulnerability affects Linux kernel developers and administrators. The vulnerability has been resolved, but it is still important to review and a [truncated]
The Linux kernel vulnerability CVE-2026-72101 relates to dm-integrity, where a bug caused uninitialized kernel memory to potentially leak when the hash size is less than the device's tuple size. The issue has been resolved with a commit that fixes the zeroing of remaining space. This vulnerability affects Linux kernel users and administrators, who should ensure their systems are updated with the latest se [truncated]
The CVE-2026-72096 vulnerability involves a race condition issue with the error counter 'v->corrupted_errs' in the Linux kernel's dm-verity component. This issue could potentially be exploited to skip auditing of corrupted blocks. The problem was resolved by making the error counter atomic. Linux kernel users and administrators should be aware of this vulnerability and take steps to ensure their systems a [truncated]