PT-2026-116689

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode kvm pkvm ioctl allowed WARNs when kvm get cap for kvm ioctl doesn't find the ioctl number in vm ioctl caps, and kvm arch vm ioctl calls it for every number the gener...

PT-2026-116737

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: pin VRAM for the whole registered range Commit c32287471077 "gpu/drm/nouveau: enable THP support for GPU memory migration" grew the device-private region that nouveau dmem chunk alloc registers from DMEM CHUNK...

PT-2026-116745

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the llc alloc frame function where link-layer headroom is reserved based solely on the device type. This approach is insufficient for stacked Ethernet devices, such as...

PT-2026-116801

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfca hci i2c repack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...

PT-2026-116828

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drm gem handle create fails virtio gpu gem create owns the reference taken by virtio gpu object create. On the drm gem handle create error path it calls drm gem object release instead of dropping...

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2024:1731430561)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2024:1731430561 advisory. - A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way...

PT-2026-116750

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6 ATTR DST In seg6 genl policy, SEG6 ATTR DST is defined with .type = NLA BINARY and .len = sizeofstruct in6 addr. For NLA BINARY, .len only enforces the maximum payload length and...

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2025:1738663576)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2025:1738663576 advisory. - In the Linux kernel, the following vulnerability has been resolved: net: atlantic: eliminate double free in error handling logic...

PT-2026-116804

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Avoid rounding zero ring sizes roundup pow of two is undefined for zero. ethtool permits a zero ring size to reach the driver, where the minimum-size check should reject it. Leave zero unchanged while rounding nonzero...

PT-2026-116692

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config Three related problems exist in the handling of KVM interrupt and page resources when a queue is removed from the host's AP configuration while assigned...

PT-2026-116673

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2 parse contexts validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose byt...

PT-2026-116731

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A use-after-free flaw exists in the drm/nouveau component. The nouveau sched destroy function calls nouveau sched fini, which invokes drm sched fini&sched-base, and subsequently releases...

PT-2026-116696

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix NULL pmu ctx passed to pmu-sched task perf pmu sched task returns early when cpuctx-task ctx is set, and cpc-task epc is only non-NULL while a task context is scheduled in on this CPU. perf pmu sched task therefore...

PT-2026-116694

In the Linux kernel, the following vulnerability has been resolved: s390/cmf: Fix virtual vs physical address confusion The measurement block address is an absolute address. Define the associated schib config and schib fields as dma64 t to enable automatic detection of incorrect assignments. Also...

PT-2026-116771

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attach perf ctx data The attach perf ctx data can race on global and !global cases. The global case is protected by global ctx data rwsem and shares a single reference count using perf ctx...

PT-2026-116776

In the Linux kernel, the following vulnerability has been resolved: gve: DQO: fix header length used by gve can send tso for UDP GSO gve can send tso computes how many buffers each segment of a GSO packet would span, and for this it needs the length of the headers that the device replicates in...

PT-2026-116674

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMM CONNINFO The RFCOMM CONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-sk state != BT CONNECTED && !rfco...

PT-2026-116680

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sock: validate event length before filtering is filtered packet reads the event code from skb-data0 without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command...

PT-2026-116769

In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRP ACK MSG to prevent bc ackers underflow Commit 48a5fe38772b "tipc: fix bc ackers underflow on duplicate GRP ACK MSG" rejected duplicate/stale ACKs in tipc group proto rcv by returning early...

PT-2026-116765

In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of PMZR EL0 writes to EL2 init el2 fgt2 writes one mask to both HDFGRTR2 EL2 and HDFGWTR2 EL2. PMZR EL0 is write-only, so its trap bit, nPMZR EL0, exists only in HDFGWTR2 EL2 and is therefore never se...