PT-2026-72704

In the Linux kernel, the following vulnerability has been resolved: tcp: clear sock ops cb flags before force-closing a child socket A child socket inherits the listener's bpf sock ops cb flags via sk clone lock. If its setup fails in tcp v4 syn recv sock / tcp v6 syn recv sock, the child is free...

PT-2026-72731

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: hdac hdmi: Validate written enum value hdac hdmi set pin port mux uses the written enum value to index the texts array before calling snd soc dapm put enum double, which validates that the value is within the enum...

PT-2026-72707

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: fix supplied from allocations If dts property power-supplies has multiple values, then accessing to psy-supplied fromi-1 in power supply populate supplied from will overrun supplied from array...

PT-2026-72727

In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen checks before using them...

PT-2026-72773

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks NMI and tracepoint BPF programs can re-enter the per-CPU or global LRU lock that bpf lru pop free/push free already hold on the same CPU, AA-deadlocking. Lockdep reports...

PT-2026-72795

In the Linux kernel, the following vulnerability has been resolved: configfs lookup: don't leave -s dentry dangling on failure Normally -s dentry is cleared when dentry it's pointing to becomes negative on eviction, realistically. However, that only happens if dentry gets to be positive in the...

PT-2026-72774

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject sleepable BPF LSM CGROUP programs at load time The cgroup shim runs under rcu read lock dont migrate, so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts...

PT-2026-72775

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Clear variable event pointer on read snd seq read copies a queued variable-length event header to userspace before expanding the payload. Queued variable-length events use SNDRV SEQ EXT CHAINED internally, and...

PT-2026-72780

In the Linux kernel, the following vulnerability has been resolved: bpf: Clear rb node linkage when freeing bpf rb root bpf rb root free detaches the root by copying the current rb root cached and then replacing the live root with RB ROOT CACHED. It then walks the copied root and drops each objec...

PT-2026-72833

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5 ib alloc transport domain allocates a transport domain and then may fail in mlx5 ib enable lb. In that case, the allocated TD is leaked. Fix this by...

PT-2026-72823

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with event input event process midi borrows msynth-output rfile.output and then passes the substream to dump midi and snd rawmidi kernel write without synchronizing with the output...

PT-2026-72824

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data The OSS sequencer processes the input MIDI bytes into a sequencer event to be dispatched later in snd seq oss midi putc called from snd seq oss process event. Wh...

PT-2026-72811

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix deadlock in read error recovery path raid1d and raid10d may resubmit a split md cloned bio while handling a read error. In this case, resubmitting the bio can lead to a deadlock if the array is suspended befo...

PT-2026-72937

In the Linux kernel, the following vulnerability has been resolved: binfmt misc: reject a flag character as the field delimiter The registration string starts with a user chosen delimiter that separates the individual fields. So that the field parsers terminate even on a truncated string create...

PT-2026-72940

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex 11n dispatch amsdu pkt splits an A-MSDU with ieee80211 amsdu to 8023s and walks the resulting subframes. For each subframe it passes the subframe data...

PT-2026-72980

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: hold conn in hci past sync callback Avoids giving freed pointers to hci conn valid, which kmalloc may have reused. Hold refcount to avoid that...

PT-2026-72972

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopf group alloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufd fault iopf handler also queued an accepted group in...

PT-2026-72970

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix list corruption in allocate file region entries allocate file region entries tops up resv-region cache with freshly allocated file region descriptors. The allocation uses GFP KERNEL, so resv-lock is dropped around...

PT-2026-72983

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci conn: hold conn reference in abort conn sync There is theoretical UAF if the conn is freed while the hci sync task is running. Hold refcount to avoid that...

PT-2026-72962

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMT OP PAIR DEVICE command by walking hdev-mgmt pending. The lookup returned a command that wa...