PT-2026-90176

In the Linux kernel, the following vulnerability has been resolved: s390/cpum cf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpu cf events at first event...

PT-2026-90189

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix power supply reference leak bq25890 fw probe acquires a reference to a secondary charger using power supply get by name, but the reference is not released on later probe failures or on driver detach. I...

PT-2026-90092

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate geometry fields from on-disk cache info cache segs init iterates cache info-n segs times indexing cache-segments, which is sized to the cache device geometry, and get seg id takes each segment id from the...

PT-2026-90139

In the Linux kernel, the following vulnerability has been resolved: io uring/query: cap user size passed to copy struct to user io handle query entry clamps hdr.size for the inbound copy from user but keeps the original user value as usize. copy struct to user uses that usize and, when it is larg...

PT-2026-90126

In the Linux kernel, the following vulnerability has been resolved: net: l2tp: do not propagate multicast notification errors The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail while allocating or encodi...

PT-2026-90116

In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has max recv sge == 1 there is no shared v2 receive buffer, and smc llc save add link rkeys takes the v2 extension from 44 bytes past the start of...

PT-2026-90097

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcxhr: initialize mutexes before requesting threaded IRQ pcxhr probe requests pcxhr threaded irq before initializing mgr-lock, even though the threaded handler takes that mutex. Initialize the manager locks before request...

PT-2026-90118

In the Linux kernel, the following vulnerability has been resolved: NTB: ntb transport: Fail TX enqueue when the QP link is down Commit f195a1a6fe41 "ntb: Drop packets when qp link is down" meant to make ntb transport tx enqueue drop packets submitted while the QP link is down, but it only return...

PT-2026-90106

In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation decap and validate pulls the outer SRv6 headers and makes the inner packet the skb network header. The IPv6 control block still contains values collected while parsing the outer packet,...

PT-2026-90193

In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp process strreset outreq, sctp process strreset addstrm out and sctp process strreset resp complete a pending stream reconfiguration request by stopping the reconf timer...

PT-2026-90218

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Free cpu buffer::free page with subbuf order When sub-buffers use an order greater than 0, cpu buffer-free page is allocated with subbuf order. Use the correct order for cpu buffer-free page...

PT-2026-90364

In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in ceph parse deleg inos ceph parse deleg inos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...

PT-2026-90194

In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctp rcv resolves the transport once per packet and leaves it in chunk-transport. The lookup reference, or the one sctp add backlog takes if the socket is owned by userspace, keeps ...

PT-2026-90210

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlm mig lockres handler A node receiving a DLM MIG LOCKRES message trusts several fields of the peer-supplied dlm migratable lockres without validation. num locks and lockname len are bounded only on th...

PT-2026-90328

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parse ntfs boot sector decoded them into an s64. A crafted high-bit value could therefore becom...

PT-2026-90304

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In ghes handle arm hw error, after skipping the cper sec proc arm header with err + 1, the remaining length was reduced by sizeoferr pointer size instead of sizeofe...

PT-2026-90258

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss krb5 unwrap v2 against short tokens gss krb5 unwrap v2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSS KRB5 TOK HDR LEN 16 bytes long, and its rotate left...

PT-2026-90253

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC 4121 MIC tokens in gss krb5 verify mic v2 gss krb5 verify mic v2 reads the token ID at ptr0..1, the flags byte at ptr2, and padding at ptr3..7, then passes ptr + GSS KRB5 TOK HDR LEN and cksum len to gss...

PT-2026-90197

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme tcp handle r2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it: nvme...

PT-2026-90237

In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle pick task releasing the rq lock Core scheduling's pick next task breaks when a -pick task implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held...