PT-2026-116683

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears next set before its final uses of the enclosing vCPU. If teardown observes next set as false while the callback is still running, kvm...

PT-2026-116684

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVM RUN. As a result, kvm riscv aia imsic rw attr can snapshot the physical CPU and HGEI of an IMSIC VS-file before a...

PT-2026-116693

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing device lock in zpci report status When pdev is non-NULL, zpci report status accesses the device's driver. To get a consistent state matching the recovery, the device lock needs to be held. Do so by expanding...

PT-2026-116706

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion br mdb flush pgs keeps a pointer-to-pointer cursor while walking mp-ports. br multicast del pg can re-enter the same MDB entry through br multicast sg del exclude ports and...

PT-2026-116746

In the Linux kernel, the following vulnerability has been resolved: gpio: zynq: fix runtime PM leak on request error path pm runtime get sync leaves the usage counter incremented even when it fails, and zynq gpio request returns the error without dropping it. gpiolib does not call -free when...

PT-2026-116747

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpio desc to lineinfo, we return immediately before zeroing the info struct we'll end up passing to the user-space later i...

PT-2026-116751

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6 find hdr return an offset past the packet end ipv6 find hdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6 optlen returns up to 2048, and the skip is...

PT-2026-116755

In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanup offline cgwbs workfn drains a dying cgwb by calling cleanup offline cgwb until it returns false, with a cond resched between passes. On a CONFIG PREEMPTION...

PT-2026-116766

In the Linux kernel, the following vulnerability has been resolved: af packet: fix integer overflow in prb calc retire blk tmo prb calc retire blk tmo computes in 32-bit int arithmetic: mbits = blk size in bytes 8 / 1024 1024; If I'm reading the validation right, tp block size is user controlled...

PT-2026-116773

In the Linux kernel, the following vulnerability has been resolved: vlan: ensure sufficient headroom in vlan dev hard header Callers that only reserve ETH HLEN or less such as llc alloc frame, or skbs allocated before dynamic device/headroom changes e.g. toggling VLAN FLAG REORDER HDR or...

PT-2026-116797

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data1 as the DSFID. Require the prefix an...

PT-2026-116812

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debug info copy When debug register static fails, it clears areas, active pages and active entries but leaves the area bounds unchanged. Copying such an area, either by opening its view...

PT-2026-116700

In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100 recv response passes the URB transfer buffer to port100 rx frame is valid, which checksums le16 to cpuframe-datalen bytes of frame-data. datalen ...

PT-2026-116779

In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's path set by the transport it ends up with rds conn create computes npaths from the caller's transport before it decides whether a connection to one of the host's own addresses is to be handled by the...

PT-2026-116791

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix immediate JMP JEQ/JNE on MIPS32 An addu instruction was emitted instead of addiu, causing the immediate value 1 to be interpreted as register $at. This made the comparison result invalid when the immediate operand was...

PT-2026-116811

In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emac tx mem map writes TX DESC 0 OWN into the ring descriptor for every slot beyond old head as soon as that slot's memset'd local copy is committed with "tx desc add...

PT-2026-116813

In the Linux kernel, the following vulnerability has been resolved: tg3: clean up PHYLIB resources on probe failure tg3 get invariants can register an MDIO bus and connect a PHY for USE PHYLIB devices. If tg3 init one later fails, its common error path releases the mappings and netdev without...

PT-2026-116816

In the Linux kernel, the following vulnerability has been resolved: net: usb: sr9700: include receive overhead in the length check The receive fixup subtracts the Ethernet CRC from the reported packet length, but compares that payload length against the whole remaining receive buffer. The followi...

PT-2026-116826

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leaks in virtio gpu resource create blob ioctl virtio gpu resource create blob ioctl calls drm gem object release on both the virtio gpu resource assign uuid and drm gem handle create error paths instead of...

PT-2026-116808

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject pkt arguments in mutating subprogs The verifier tracks changes in how PTR TO PACKET registers' bounds are modified across subprog boundaries. PTR TO PACKET registers are actually passed as PTR TO MEM, which is assumed...