PT-2026-116823

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpn bind is published through peer-bind with RCU, but local endpoint learning updates bind-local in place under peer-lock. UDP TX reads the field without that lock. In...

PT-2026-116676

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2cap data rcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefo...

PT-2026-116699

In the Linux kernel, the following vulnerability has been resolved: nfc: trf7970a: power down on startup RX gain failure trf7970a startup powers up the device before applying the optional RX gain reduction. If the register read or write fails, it returns without undoing that power-up. Probe's...

PT-2026-116749

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix permanent hang when flushing the kprobe optimizer Writing 0 to /proc/sys/debug/kprobes-optimization while a kprobe is jump-optimized never returns. The writer sleeps in D state forever with kprobe sysctl mutex held, ...

PT-2026-116756

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current pwq deref in flush dependency check check flush dependency uses current wq worker to determine whether the caller is a workqueue worker and then dereferences worker-current pwq to test whether the...

PT-2026-116759

In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraph data list when the reservation is not filled fprobe fgraph entry reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0. fgraph...

PT-2026-116767

In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled ERRORStale CookieDATA packet from one of its non-primary addresses, processing the ERROR chun...

PT-2026-116772

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofs kill sb When autofs fill super fails before clearing AUTOFS SBI CATATONIC for example, when find get pid fails on an invalid pgrp mount option, or when an fs context is closed...

PT-2026-116783

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq mt7530 remove common disposes the per-PHY interrupt mappings from .remove, but the regmap-irq chip that owns the domain is devm-registered, so its parent interrupt is on...

PT-2026-116798

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfc genl llc sdreq builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths nested-attr parse failure, TLV alloc ENOMEM, nfc llcp send snl sdr...

PT-2026-116810

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skb pointer if linear function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. Th...

PT-2026-116653

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A range check was missing in the proc dointvec ms jiffies minmax function within the sysctl component. This occurred because a previous update to replace the SYSCTL INT CONV CUSTOM macro...

PT-2026-116674

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMM CONNINFO The RFCOMM CONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-sk state != BT CONNECTED && !rfco...

PT-2026-116679

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore subm...

PT-2026-116683

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears next set before its final uses of the enclosing vCPU. If teardown observes next set as false while the callback is still running, kvm...

PT-2026-116684

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVM RUN. As a result, kvm riscv aia imsic rw attr can snapshot the physical CPU and HGEI of an IMSIC VS-file before a...

PT-2026-116692

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config Three related problems exist in the handling of KVM interrupt and page resources when a queue is removed from the host's AP configuration while assigned...

PT-2026-116693

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing device lock in zpci report status When pdev is non-NULL, zpci report status accesses the device's driver. To get a consistent state matching the recovery, the device lock needs to be held. Do so by expanding...

PT-2026-116706

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion br mdb flush pgs keeps a pointer-to-pointer cursor while walking mp-ports. br multicast del pg can re-enter the same MDB entry through br multicast sg del exclude ports and...

PT-2026-116746

In the Linux kernel, the following vulnerability has been resolved: gpio: zynq: fix runtime PM leak on request error path pm runtime get sync leaves the usage counter incremented even when it fails, and zynq gpio request returns the error without dropping it. gpiolib does not call -free when...