PT-2026-90202

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free of cmd rcvr in ipmi destroy user Commit 9e91f8a6c868 "ipmi:msghandler: Remove srcu for the ipmi interfaces list" dropped the synchronize rcu between unlinking the command receivers from intf-cmd rcvrs and...

PT-2026-90464

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simple ring buffer swap reader page starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful...

PT-2026-90421

In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rq status counter to even on all nfsd dispatch exit paths nfsd dispatch sets rq status counter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a...

PT-2026-90427

In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARN ON ONCE from nfsd mode check The header for commit e75b23f9e323 "nfsd: check d can lookup in fh verify of directories" details the assumption that justified adding the WARN ON ONCE to nfsd mode check, tha...

PT-2026-90410

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOAD CANCEL path clp != NULL, manage cpntf state freed the target cpntf state without checking ownership. The lookup key st-si opaque.so id is allocated...

PT-2026-90404

In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqid op replay retry In nfs4 preprocess seqid op the stateid is obtained from nfsd4 lookup stateid, which holds a reference on the nfs4 stid sc count but takes no reference on the...

PT-2026-90409

In the Linux kernel, the following vulnerability has been resolved: nfsd: check nfsd4 acl to attr return value in nfsd4 create nfsd4 create stores the return value of nfsd4 acl to attr in status, but the switchcreate-cr type block unconditionally overwrites it in every branch. ACL translation...

PT-2026-90485

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp setup state error path When cpuhp setup state fails after pit clockevent per cpu init has successfully called request irq, the error handling jumps directly to out pit clocksourc...

PT-2026-90442

In the Linux kernel, the following vulnerability has been resolved: lib/ucs2 string.c: fix out-of-bounds read in ucs2 strnlen Patch series "lib/ucs2 string.c: fix out-of-bounds read in ucs2 strnlen", v2. This series fixes an off-by-one out-of-bounds read in ucs2 strnlen. The first patch is the re...

PT-2026-90463

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in trace pipe read on sub-buffer order change Writing to buffer subbuf size kb calls ring buffer subbuf order set, which frees every sub-buffer of the ring buffer, including the reader page, and replac...

PT-2026-90482

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold exec update lock around namespace ioctl The PIDFD GET NAMESPACE ioctls in pidfd ioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment state...

PT-2026-90443

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: GICv2: Don't WARN on out-of-range GICV DIR INTID vgic v2 deactivate passes the INTID a guest wrote to GICV DIR straight to vgic get vcpu irq, and treats a failed lookup as a "can't happen" condition with WARN ON ONCE...

PT-2026-90472

In the Linux kernel, the following vulnerability has been resolved: mm/migrate: report RCU-tasks quiescent states in migrate pages batch migrate pages batch unmaps each folio before moving it, and every unmap runs the mmu notifier invalidate callbacks. On KVM hosts try to migrate ends up in kvm m...

PT-2026-90486

In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fs bio integrity alloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fs bio integrity free...

PT-2026-90429

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd setattr checks whether a size update needs NFSD MAY TRUNC before it takes inode lock. The comparison uses the file size sampled by that unlocked read, but the actual ATTR SIZE...

PT-2026-90262

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprt complete bc request removes the request from bc pa list, drops bc...

PT-2026-90137

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmb write read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block wri...

PT-2026-90088

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cache replay, the writeback worker and the GC worker bounds its length by PCACHE SEG SIZE - seg off, the raw segment size rather than the data...

PT-2026-90080

In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesas i3c xfer, enqueues it, and waits for completion. The interrupt...

PT-2026-90386

In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsd file objects are freed via call rcu filecache.c:296, and nfsd file slab is created without SLAB TYPESAFE BY RCU KMEM CACHEnfsd file, 0 at filecache.c:789, so the slab page backing ...