PT-2026-85733

In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak on open O TRUNC DAX failure fuse open takes filemap invalidate lock for a DAX truncate dax truncate = true and releases it before the out inode unlock label. But when fuse dax break layouts fails, t...

PT-2026-85739

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: bail out of setup if the controller is inaccessible xhci gen setup locates the operational registers using the capability length read from the very first register: xhci-op regs = hcd-regs + HC LENGTHreadl&xhci-cap...

PT-2026-85654

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet execute identify nslist When a host issues an Identify command with CNS 07h Active Namespace ID List for a specific I/O Command Set, nvmet execute identify nslist is called with match...

PT-2026-85639

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: reject PDUs shorter than the LLCP header Every LLCP PDU begins with a two-byte header DSAP/SSAP + PTYPE, but the receive path never checked that a frame is at least LLCP HEADER SIZE bytes before parsing it. nfc llcp rx...

PT-2026-85619

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Reject cross-mm private futex owners A private futex key borrows the waiter's mm without taking an mm users reference. Nevertheless, attach to pi owner currently accepts an owner from a different address space and copie...

PT-2026-85636

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds write in nci target auto activated nci target auto activated appends a target to the fixed-size array ndev-targetsNCI MAX DISCOVERED TARGETS and increments ndev-n targets without first checking the arr...

PT-2026-85612

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: register input device after capabilities are set input register device exposes the device to userspace immediately. In joycon input create it was called before joycon config rumble configures the FF RUMBLE capabili...

PT-2026-85623

In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: do not keep a stale msc-input if no input is claimed magicmouse input mapping caches the first hid input's input dev in msc-input while the report descriptor is parsed, and the rest of the driver treats a non-NUL...

PT-2026-85716

In the Linux kernel, the following vulnerability has been resolved: vxlan: keep the last remote linked during FDB flush A non-nexthop FDB entry is expected to have at least one remote while it remains reachable through the FDB hash table. A filtered bulk flush violates this invariant when every...

PT-2026-85735

In the Linux kernel, the following vulnerability has been resolved: fuse: wait for FR FINISHED on abort on kill to prevent use-after-free The abort on kill path in request wait answer calls fuse abort conn and returns without waiting for FR FINISHED. If fuse dev do write is concurrently processin...

PT-2026-85599

In the Linux kernel, the following vulnerability has been resolved: futex: Avoid private hash use-after-free on final put futex private hash put drops the reference to fph before evaluating fph-mm for wake up var. futex ref put enables preemption again before returning. If that put drops the fina...

PT-2026-85608

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix use-after-free in enable sensor enable sensor store can call set power report state, which dereferences sensor inst-power state and sensor inst-report state. These pointers refer to entries in sensor...

PT-2026-85720

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the bridge multicast component of the Linux kernel. The problem occurs during the teardown of a master VLAN's multicast context. Specifically, the br...

PT-2026-85738

In the Linux kernel, the following vulnerability has been resolved: fuse: fix race between interrupt and resend After commit f8fce75fedf7 "fuse: clear intr entry in fuse resend and fuse remove pending req" the WARN ON!list empty&req-intr entry in fuse request free still triggers due to the...

PT-2026-85737

In the Linux kernel, the following vulnerability has been resolved: fuse: fix missing barrier when checking io-uring readiness fuse block alloc reads fch-initialized and then fch-io uring. fch-io uring is set before fch-initialized, ordered by the smp wmb in fuse chan set intialized, but fuse blo...

PT-2026-85732

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f tcm: keep port count until LUN teardown completes tcm usbg drop nexus permits session removal once tpg port count reaches zero. However, usbg port unlink currently decrements that count from the fabric pre unlink...

PT-2026-85616

In the Linux kernel, the following vulnerability has been resolved: futex: Fix race on the initial mm-futex.phash.ref allocation futex hash allocate allocates mm-futex.phash.ref without any locking. Commit d9b05321e21e "futex: Move futex hash free back to mmput" moved the allocation here and...

PT-2026-85736

In the Linux kernel, the following vulnerability has been resolved: fuse: publish io-uring queues with release semantics fuse uring create queue initializes a fuse ring queue and then publishes the pointer into ring-queuesqid with WRITE ONCE under the fch-lock. There are several readers that may...

PT-2026-85648

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid block index in GC ioctl Syzbot reported list corruption caused by a double list add tail call on bh-b assoc buffers within nilfs lookup dirty data buffers. Analysis revealed that the root cause was the...

PT-2026-85645

In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context unconditionally in xfs trans roll When xfs trans commit fails in xfs trans roll, the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection,...