PT-2026-116691

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Free have run cpus during VM destruction even if VM is no longer SEV Unconditionally free SEV's "have run CPUs" cpumask in the VM destroy path, i.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV...

PT-2026-116695

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccw device get util str The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpid to chp can retu...

PT-2026-116702

In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfc get local general bytes Commit 6709d4b7bc2e "net: nfc: Fix use-after-free caused by nfc llcp find local" attempted to fix a use-after-free UAF issue by invoking nfc llcp local putlocal after accessi...

PT-2026-116723

In the Linux kernel, the following vulnerability has been resolved: PCI: of property: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

PT-2026-116738

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix runtime PM leak in amdgpu debugfs test ib show amdgpu debugfs test ib show resumes the device with pm runtime get sync before taking the reset domain semaphore with down write killable. If the write lock acquisiti...

PT-2026-116740

In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix incorrect RCU teardown order i915 gem busy ioctl uses dma resv for each fence unlocked to iterate over the fences in an GEM object without holding a reference but only the RCU read side lock. What can happen here is...

PT-2026-116741

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvr mmu map sgl Map failure from pvr mmu map sgl interface was not returned correctly to pvr mmu map interface. This resulted in pvr mmu map interface to continue instead of...

PT-2026-116743

In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rds ib map frmr stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, rds rdma map unpins the pages and frees the scatterlist, but...

PT-2026-116757

In the Linux kernel, the following vulnerability has been resolved: writeback: bound cleanup offline cgwb rescans by rotating scanned inodes cleanup offline cgwb prepares at most WB MAX INODES PER ISW inodes per call and is called again until the dying wb is drained, but every call walks wb-b...

PT-2026-116778

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on lgr list traversal in smcr port err smcr port err traverses smc lgr list.list without holding smc lgr list.lock, allowing a concurrent smc lgr terminate sched to free an lgr while it is still being dereference...

PT-2026-116806

In the Linux kernel, the following vulnerability has been resolved: firewire: cdev: fix back-transition for iso resource auto client resource The todo member of iso resource auto structure represents the state of the client resource and normally transitions in the following order: ISO RES AUTO...

PT-2026-116807

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject max entries INT MAX in sock map alloc sock map alloc only rejects max entries == 0 and otherwise allows any u32 value. sock map free then walks the sks array with a signed int iterator: int i; for i = 0; i...

PT-2026-117083

In the Linux kernel, the following vulnerability has been resolved: sched ext: Wait for SCX OPSS DISPATCHING before reenqueueing a task ebf1ccff79c4 "sched ext: Fix ops.dequeue semantics" moved the final ops state store in scx dispatch enqueue after the DSQ unlock so that the custody update and...

PT-2026-117086

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory cache key decode takes a key's logical off from the cache device and later indexes req key tree-subtrees by it in get subtree. An off past the device forms a subtree...

PT-2026-116733

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validate init On the ttm bo reserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drm gem objec...

PT-2026-116762

In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in path unlink/path rmdir bpf lsm has d inode locked makes the verifier rewrite bpf set|remove dentry xattr to the locked variants, which assume that the caller already holds the...

PT-2026-116677

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hci bind cis and hci connect cis return one hci conn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by iso conn fre...

PT-2026-116718

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacom wac pen serial enforce The 'wacom wac pen serial enforce' function may calculate and pass an invalid offset to hid field extract, resulting in memory reads at incorrect addresses -- possibly beyo...

PT-2026-116734

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvif vmm dtor On failure, nouveau cli init calls nouveau cli fini to tear the client down. Then, nouveau drm open also enters into its cleanup path and calls nouveau cli fini AGAIN. nouveau cli fin...

PT-2026-116742

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drm atomic.c:2031 at drm atomic helper set config+0x18e/0x1b0 drm Call Trace: drm...