PT-2026-72496

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw sp port lag join When mlxsw sp port lag index get fails, mlxsw sp port lag join returns an error without releasing the lag reference obtained by the earlier mlxsw sp lag get. All other error path...

PT-2026-72791

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix RB-tree corruption in probe error path The info-node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the device rbtree insert call is skipped. If a subsequent probe step fails, th...

PT-2026-72749

In the Linux kernel, the following vulnerability has been resolved: vduse: hold vduse lock across IDR lookup in open path vduse dev open looks up struct vduse dev through the IDR and then acquires dev-lock only after vduse lock has been dropped. This leaves a window where a concurrent VDUSE DESTR...

PT-2026-72364

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: put stats for scheme add dirs internal error damon sysfs scheme add dirs setup the tried regions directory after the stats directory setup is completed. When the tried regions directory setup is failed, th...

PT-2026-72822

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmet tcp alloc queue, when a connection is closed during the allocation process e.g., nvmet tcp set queue sock returns -ENOTCONN, the error handling jumps to out destroy s...

PT-2026-72460

In the Linux kernel, the following vulnerability has been resolved: fbdev: radeon: fix potential memory leak in radeonfb pci register The function radeonfb pci register allocates memory for modelist by calling radeon check modes which calls fb add videomode. The memory is appended to info-modelis...

PT-2026-72384

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound copy lcns dp-page lcns index in analysis pass In log replay's analysis pass, after find dp returns a valid DIR PAGE ENTRY for the target attr, target vcn tuple, the copy lcns block walks lrh-lcns follow further...

PT-2026-72535

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt connmark: reject invalid shift parameters Revision 2 of the CONNMARK target accepts user-controlled shift parameters and applies them to 32-bit mark values in connmark tg shift. A shift bits value of 32 or more...

PT-2026-73060

Name of the Vulnerable Software and Affected Versions Pandora affected versions not specified Description Pandora contains a path traversal issue in its TAR archive extraction functionality. The extractor passes archive member names directly to the tarfile.TarFile.extract function without applyin...

PT-2026-72804

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12k wifi7 dp rx h verify tkip mic In ath12k wifi7 dp rx h verify tkip mic, the call to ath12k dp rx check nwifi hdr len valid may return false when the NWIFI header length is invalid, causing t...

PT-2026-72618

In the Linux kernel, the following vulnerability has been resolved: net/sched: act ct: fix nf connlabels leak on two error paths tcf ct fill params calls nf connlabels get setting put labels when TCA CT LABELS is present, but two later error sites use a bare return instead of "goto err", skipping...

PT-2026-72549

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hw engine: Fix double-free of managed BO in error path The error path in hw engine init explicitly frees a BO allocated with xe managed bo create pin map via xe bo unpin map no vm. Since the managed BO already has a devm...

PT-2026-72215

In the Linux kernel, the following vulnerability has been resolved: irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure imsic early acpi init allocates a firmware node before setting up the IMSIC state. If imsic setup state fails, the function returns without freeing the allocat...

PT-2026-72375

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid self-deadlock during inode eviction An attribute-list update performed while allocating clusters can drop the last reference to the temporary attribute inode. Evicting that inode drops its reference to the base inode...

PT-2026-72159

Name of the Vulnerable Software and Affected Versions Groundhogg versions prior to 4.5.15 Description The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress contains a SQL Injection flaw. Authenticated attackers with vendor-level access or higher can append malicious SQL...

PT-2026-72452

In the Linux kernel, the following vulnerability has been resolved: fbdev: tridentfb: fix potential memory leak in trident pci probe In trident pci probe, the memory allocated for modelist using fb videomode to modelist is not freed in subsequent error paths. Fix that by calling fb destroy modeli...

PT-2026-72201

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tracing/osnoise component where the synchronize rcu function is not called during unregistration. This failure to synchronize allows the reference on the tracer to...

PT-2026-72978

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix potential deadlock in mpi3mr fault uevent emit mpi3mr fault uevent emit runs from the fault watchdog and reset paths where host I/O may already be blocked. GFP KERNEL allocations here, both the local kzalloc obj...

PT-2026-72193

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix memory leak in ieee80211 register hw If kmemdup fails while copying supported band structures, the error path jumps to fail rate. This skips rate control deinitialize and leaks the initialized local-rate ctrl...

PT-2026-72747

In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: tear down old virtqueues before restore virtio device restore resets the device and restores the negotiated features before calling -restore. viortc freeze intentionally leaves the existing virtqueues in place so the...