PT-2026-117086

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory cache key decode takes a key's logical off from the cache device and later indexes req key tree-subtrees by it in get subtree. An off past the device forms a subtree...

PT-2026-116733

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validate init On the ttm bo reserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drm gem objec...

PT-2026-116762

In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in path unlink/path rmdir bpf lsm has d inode locked makes the verifier rewrite bpf set|remove dentry xattr to the locked variants, which assume that the caller already holds the...

PT-2026-116677

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hci bind cis and hci connect cis return one hci conn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by iso conn fre...

PT-2026-116718

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacom wac pen serial enforce The 'wacom wac pen serial enforce' function may calculate and pass an invalid offset to hid field extract, resulting in memory reads at incorrect addresses -- possibly beyo...

PT-2026-116734

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvif vmm dtor On failure, nouveau cli init calls nouveau cli fini to tear the client down. Then, nouveau drm open also enters into its cleanup path and calls nouveau cli fini AGAIN. nouveau cli fin...

PT-2026-116742

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drm atomic.c:2031 at drm atomic helper set config+0x18e/0x1b0 drm Call Trace: drm...

PT-2026-116753

In the Linux kernel, the following vulnerability has been resolved: ipe: fix use-after-free when auditing a newly loaded policy new policy audits the policy after ipe new policyfs node publishes it and drops the new directory's inode lock. A concurrent delete can free the policy while ipe audit...

PT-2026-116754

In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in read dts node of clk get returns a clock with its reference count incremented, but read dts node only uses it to read the rate and never calls clk put. The clock is not stored anywhere, so the...

PT-2026-116781

In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix races in Tx timestamp handling wx-ptp tx skb is shared between the Tx path, the PTP auxiliary worker and the timestamp cleanup paths. The WX STATE PTP TX IN PROGRESS bit prevents multiple Tx paths from submitting...

PT-2026-116794

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533 acr122 is rx frame valid frame-ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame-data. A malicious or malfunctioning device can set this field ...

PT-2026-116686

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 "KVM: arm64: nv: Handle VNCR EL2 invalidation from MMU notifiers" introduced VNCR EL2 invalidation in both kvm nested s2 unmap and kvm neste...

PT-2026-116697

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 "scsi: ufs: core: Switch to scsi get internal cmd" switched UFS internal commands to allocate requests on hba-host-pseudo sdev-request...

PT-2026-116710

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1...

PT-2026-116713

In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on out-of-range cmb tpd next to clean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpd cons read": the hardware can report an out-of-range c...

PT-2026-116714

In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arp dev field may contain IFNAMSIZ bytes without a NUL terminator. Such input is passed to dev get by name...

PT-2026-116732

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix runtime PM leak in nouveau connector detect If nvif outp edid get fails, nouveau connector detect returns early without dropping the runtime PM reference taken at the start of the function, keeping the device...

PT-2026-116739

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix use-after-free and multi-container gap in kfd dev mapping kfd dev mapping caches the address space of the first /dev/kfd opener so that the GPU reset path can call unmap mapping range to zap all userspace mappings...

PT-2026-116748

In the Linux kernel, the following vulnerability has been resolved: gpio: arizona: Fix runtime PM leak in arizona gpio direction out Switching a persistent GPIO line from input to output acquires a runtime PM reference on the parent device, but if the subsequent regmap update bits fails the...

PT-2026-116761

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Return PERR NOCPUS in remote partition enable on subpartitions cpus conflict When a remote partition is created underneath an existing local partition via a non-partition PRS MEMBER intermediate cgroup, update...