PT-2026-51728

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xfrm espintcp component where the system may reuse an in-progress partial send. Specifically, the espintcp sendmsg function may reinitialize emsg-skmsg and reuse...

PT-2026-51865

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the get timestamp function of the ENA network driver. The problem occurs because the phc-active check and the assignment of the resp pointer were perform...

PT-2026-51840

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock can occur in the send sigio and send sigurg functions when a process group receives a signal. This happens because these functions use read lock&tasklist lock to traverse the...

PT-2026-51854

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.18 Description An issue exists in the ceph component where folios not suitable for writeback are not properly released. Because the batch maintains references to the folios through filemap get folios and folio...

PT-2026-51885

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between the pressure write operation and the cgroup file release process. This occurs because the priv member of the struct kernfs open file is not sufficiently...

PT-2026-51870

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Two error handling issues exist within the drm/xe graphics driver in the xe exec queue create ioctl function. The first issue occurs when xe hw engine group add exec queue fails; the err...

PT-2026-51850

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds memory access exists in the ceph x decrypt function within libceph. The issue occurs because a portion of buffer p is interpreted as a ceph x encrypt header and its magi...

PT-2026-51881

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double free flaw exists in the drm/amdgpu component within the userq validate function. The issue occurs when amdgpu userq vm validate calls the drm exec fini function on an execution...

PT-2026-51991

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the mt76 wireless driver for the mt7996 PCI chip. A race condition occurs when the chip is detaching; the mt7996 coredump unregister function releases...

PT-2026-51707

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the batman-adv module where the running payload length for queued fragments can be truncated during updates. This allows malformed fragment chains to bypass validation...

PT-2026-51939

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tegra124-emc memory component where the logic used to verify if the specified memory timing enables the Delay-Locked Loop DLL in the EMRS register was reversed. Th...

PT-2026-51966

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A locking issue exists in the Bluetooth subsystem within the hci conn request evt function when the protocol is set to HCI PROTO DEFER. In this state, the function calls hci connect...

PT-2026-51925

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the arena alloc pages function accepts an integer node id and forwards it through the allocation chain without performin...

PT-2026-51948

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/msm component where a wrong argument caused objects involved in UNMAP operations to not be consistently locked. This behavior specifically affects non- NO SHAR...

PT-2026-51903

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw in the ice network driver occurs during network packet transmission. When the ice tso or ice tx csum functions fail, the error path in ice xmit frame ring frees the network buffer...

PT-2026-51841

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qrtr port remove function where the socket reference count is decremented using sock put before the port is removed from the qrtr ports XArray and before the RCU...

PT-2026-51930

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An off-by-one error exists in the arm64 BPF JIT Just-In-Time compiler within the check immbits, imm macro. This macro is used to verify that a branch displacement fits into the signed...

PT-2026-51715

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the batman-adv module where the batadv dat forward data function calls pskb copy for clone to duplicate an skb for each DHT candidate without verifying the return valu...

PT-2026-51956

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In passthrough mode, the invalidate mapping operation within the dm cache policy smq is called simultaneously by multiple workers without proper lock protection. This lack of...

PT-2026-51949

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the hisilicon/sec2 crypto component. Under heavy load during packet transmission, the hardware may complete packet processing and free the request memory...