PT-2026-121918

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4 irq disable masks the V3D interrupt sources and then calls synchronize irq before the V3D is powered down. However, by itself, this is not enough to quiesce the...

PT-2026-121869

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter ipset component regarding the improper marking of RCU Read-Copy-Update locked areas. Specifically, the RCU lock is unnecessarily held when incrementing t...

PT-2026-121877

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb write pointer with invalidate lock sb write pointer reads the super block from the block device page cache using read cache page gfp. This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568...

PT-2026-121946

In the Linux kernel, the following vulnerability has been resolved: net/sched: em text: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a "net/sched: fix potential stack infoleak in em text dump", which zero-initialised the dump-side struct. Sashiko pointed at a...

PT-2026-121970

In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNT UMOUNT in clone mnt MNT UMOUNT gets raised on a mount that umount tree or umount one has taken out of its namespace. It's never cleared. detach mounts unhooks a mount that carries it instead of...

PT-2026-121983

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for eb relocate parse slow to call kvfree on entries outside the original exec array during following scenario inside eb relocate parse slow: 1 eb copy...

PT-2026-121955

In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. do umount refuses to unmount locked mounts but shrink submounts doesn't. A shrinkable mount...

PT-2026-121972

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mnt change mountpoint umount mnt resets -overmount of the parent when it unmounts the mount that overmounts it. mnt change mountpoint doesn't. It moves the mount to its new parent a...

PT-2026-121921

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vm bo handling in remap When a map overlaps part of an existing mapping, pvr vm gpuva remap splits the mapping into prev/next parts covering what the request did not take, instead of creating...

PT-2026-121976

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinned link entry when fb-pin performs the final unpin xe bo pin external and xe bo unpin external maintain the bo's pinned link list membership in xe-pinned.late.external, based on whether the current call is t...

PT-2026-121991

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: Fix command skb lifetime during scan setup During PA sync scan setup, hci le set ext scan param sync gets the address used for the PA LINK lookup from hci sent cmd data. The returned pointer borrows storage...

PT-2026-122031

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipc topsrv stop closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could...

PT-2026-122047

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6 info hw flags set sizes the skb with rt6 nlmsg size and later fills it with rt6 fill node. With nexthop compatibility mode enabled, a concurrent replacement can grow the grou...

PT-2026-121958

In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink, rmdir and rename remove the entry from the filesystem, call detach mounts on the entry with the inode locked and then call d delete once the inode is unlocked...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions 4.19.299 through 4.20 and 5.1. It arises because smcgetname dereferences smc-clcsock without holding a clcsockreleaselock; this allows the link group to asynchronously release CLC sockets, potentially leading to use-after-free conditions or...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.11. It arises because tipctopsrvstop closes subscriber connections while the send and receive work queues of the topology server are still active, potentially leading to use-after-free conditions, execution of queuework on already-destroye...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.6. It stems from improper handling of response message consumption by the wireguard noise module after intermediate initialization; this results in a race condition that may lead to inconsistent handshake states or repeated session...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.12. It stems from a race condition related to the size of IPv6 routing notifications. When fib6infohwflagsset uses rt6nlmsgsize to set the skb size, it is subsequently filled by rt6fillnode. In Nexthop-compatible mode, concurrent...

PT-2026-121861

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211 rx mgmt deauth reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame...

PT-2026-121885

In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2 video unregister device on driver removal The driver uses vb2 fop release as its file release operation, so vb2 video unregister device should be used instead of video unregister device during driver...