PT-2026-116667

In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM points out that we leak the igrab'd reference to the orphanage directory inode if chowning it fails. Fix that...

PT-2026-116678

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hci bind bis hci conn link takes a lifetime reference to its parent with hci conn get, but only takes an operational hold on the child. hci conn unlink later balances both a hold and a...

PT-2026-116701

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfc llcp recv hdlc nfc llcp recv hdlc reads the sequence byte skb-data2, via nfc llcp ns/nfc llcp nr, before any length check. The receive path only guarantees the two-byte LLCP header -...

PT-2026-116736

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveau uvmm sm when BO is in TTM PL SYSTEM nouveau uvmm sm calls op map, which passes bo-resource through nouveau mem to nouveau uvma map. nouveau uvmm vmm map then reads mem-mem.type. But this is on...

PT-2026-116819

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm recv frame While rfcomm recv frame verifies that skb-len is at least sizeofhdr + 1 4 bytes: 3-byte header + 1-byte FCS, an RFCOMM frame with an extended 2-byte length field !...

PT-2026-116682

In the Linux kernel, the following vulnerability has been resolved: sched ext: Derive SCX RQ IN WAKEUP from the core enqueue flags schedule deferred locked skips scheduling a deferred action while SCX RQ IN WAKEUP is set and relies on the task woken scx call that follows a wakeup enqueue to run i...

PT-2026-116688

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix AArch32 DBGBXVR handling The consolidation of the breakpoint and watchpoint register accessors switched DBGBXVR from trap bvr to trap dbg wb reg. The latter selects backing storage with demux wb reg, which only...

PT-2026-116698

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi tcp: Check the data direction of a Data-In PDU The Data-In branch of iscsi tcp hdr dissect resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the...

PT-2026-116704

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t rt: fix zero-address non-strict match out-of-bounds read rt mt6 check permits rules to be configured with rtinfo-addrnr == 0 even when address matching IP6T RT FST MASK is requested. In the IP6T RT FST NSTRICT pat...

PT-2026-116792

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix pull-bound underflow in skb checksum setup ipv6 skb maybe pull tail subtracts skb headlenskb from the unsigned max argument and passes the result to pskb pull tail as a signed int. The function does not ensure th...

PT-2026-116689

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode kvm pkvm ioctl allowed WARNs when kvm get cap for kvm ioctl doesn't find the ioctl number in vm ioctl caps, and kvm arch vm ioctl calls it for every number the gener...

PT-2026-116737

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: pin VRAM for the whole registered range Commit c32287471077 "gpu/drm/nouveau: enable THP support for GPU memory migration" grew the device-private region that nouveau dmem chunk alloc registers from DMEM CHUNK...

PT-2026-116745

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the llc alloc frame function where link-layer headroom is reserved based solely on the device type. This approach is insufficient for stacked Ethernet devices, such as...

PT-2026-116801

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfca hci i2c repack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...

PT-2026-116828

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drm gem handle create fails virtio gpu gem create owns the reference taken by virtio gpu object create. On the drm gem handle create error path it calls drm gem object release instead of dropping...

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2024:1731430561)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2024:1731430561 advisory. - A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way...

PT-2026-116750

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6 ATTR DST In seg6 genl policy, SEG6 ATTR DST is defined with .type = NLA BINARY and .len = sizeofstruct in6 addr. For NLA BINARY, .len only enforces the maximum payload length and...

PT-2026-116804

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Avoid rounding zero ring sizes roundup pow of two is undefined for zero. ethtool permits a zero ring size to reach the driver, where the minimum-size check should reject it. Leave zero unchanged while rounding nonzero...

PT-2026-116692

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config Three related problems exist in the handling of KVM interrupt and page resources when a queue is removed from the host's AP configuration while assigned...

PT-2026-116673

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2 parse contexts validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose byt...