PT-2026-72630

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix and simplify IP6IP6 tunnel handling Fix nf flow ip6 tunnel proto to use pskb may pull instead of skb header pointer to ensure the outer IPv6 header is in the skb headroom, which is required for subsequen...

PT-2026-72509

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential memory leaks in igmp mod timer and igmp stop timer When a timer is deleted and not re-armed in igmp mod timer, or stopped in igmp stop timer, the code currently decrements the reference counter of the...

PT-2026-72566

In the Linux kernel, the following vulnerability has been resolved: afs: Fix error code in afs extract vl addrs The error codes on these paths are only set on the first iteration through the loop. Set the correct error code on every iteration...

PT-2026-72559

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFS VOLUME RM TREE is set on Fix afs insert volume into cell to set AFS VOLUME RM TREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volum...

PT-2026-72513

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path Branch Sampling BRS and Last Branch Record LBR are mutually exclusive hardware features, and users of both are tracked via cpuc-lbr users. When SVM is toggled on a CP...

PT-2026-72544

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs issue read Fix missing release of credits in the failure path in cifs issue read lest retrying the subreq just overwrites the credits value...

PT-2026-72561

In the Linux kernel, the following vulnerability has been resolved: afs: Fix missing NULL pointer check in afs break some callbacks Fix afs break some callbacks to check to see if afs lookup volume rcu returned NULL e.g. the specified volume is unknown...

PT-2026-72524

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control get l2cap conn looks up an LE hci conn under hdev protection, but then drops that protection before reading hcon-l2cap data and before lowpan control write later...

PT-2026-72552

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix writeback error handling Fix the error handling in writeback iter loop. If an error occurs, writeback iter needs to be called again with error set to the error so that it can clean up iteration state. Further, the...

PT-2026-72528

In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: fix races on the shared Super VCAP block The VCAP instances on a chip are not independent, yet they are locked independently. On sparx5 and lan969x the IS0 and IS2 instances are backed by the same Super VCAP...

PT-2026-72572

In the Linux kernel, the following vulnerability has been resolved: irqchip/ts4800: Fix missing chained handler cleanup on remove The driver installs a chained handler for the parent interrupt during probe using irq set chained handler and data, but the remove function does not clear this handler...

PT-2026-72549

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hw engine: Fix double-free of managed BO in error path The error path in hw engine init explicitly frees a BO allocated with xe managed bo create pin map via xe bo unpin map no vm. Since the managed BO already has a devm...

PT-2026-72808

In the Linux kernel, the following vulnerability has been resolved: raid1: fix nr pending leak in REQ ATOMIC bad-block error path In raid1 write request, each per-mirror loop iteration begins by incrementing rdev-nr pending. If a REQ ATOMIC write encounters a badblock within the requested range,...

PT-2026-72612

In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313 rtc probe calls devm request irq with IRQF SHARED and &pdev-dev as the cookie, but platform set drvdata is only called later after the clock setup. With a shared I...

PT-2026-72656

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize re id before removal registration rpcrdma create id registers ep-re rn with the rpcrdma ib client before returning the new rdma cm id to rpcrdma ep create. However rpcrdma ep create currently stores that...

PT-2026-72490

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Use overflow checks in control update size calc In sof ipc3 control update, the expected size calculation uses firmware-provided cdata-num elems in arithmetic that could overflow on 32-bit platforms,...

PT-2026-72854

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Fix potential tracepoint null pointer dereferences Trace dma fence signaled, trace dma fence wait end and trace dma fence destroy can all currently dereference a null fence-ops pointer after it has been reset on fence...

PT-2026-72856

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Reject VMAs with VM IO or VM PFNMAP when creating SVM ranges VMAs marked with VM IO or VM PFNMAP are not backed by struct page objects, which GPUSVM requires in order to operate correctly. In particular, get pages...

PT-2026-72502

In the Linux kernel, the following vulnerability has been resolved: regulator: core: regulator lock two should test for EDEADLK not EDEADLOCK Compare against -EDEADLK, which is what ww mutex lock actually returns and what every other deadlock check in this file already uses. Function regulator lo...

PT-2026-72374

In the Linux kernel, the following vulnerability has been resolved: ntfs: make system files immutable to prevent corruption When a system file such as $Bitmap is exposed via show sys files and written from userspace, the volume is corrupted and, because the cluster allocator scans $Bitmap through...