PT-2026-116737

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: pin VRAM for the whole registered range Commit c32287471077 "gpu/drm/nouveau: enable THP support for GPU memory migration" grew the device-private region that nouveau dmem chunk alloc registers from DMEM CHUNK...

PT-2026-116801

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfca hci i2c repack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...

PT-2026-116828

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drm gem handle create fails virtio gpu gem create owns the reference taken by virtio gpu object create. On the drm gem handle create error path it calls drm gem object release instead of dropping...

PT-2026-116750

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6 ATTR DST In seg6 genl policy, SEG6 ATTR DST is defined with .type = NLA BINARY and .len = sizeofstruct in6 addr. For NLA BINARY, .len only enforces the maximum payload length and...

PT-2026-116804

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Avoid rounding zero ring sizes roundup pow of two is undefined for zero. ethtool permits a zero ring size to reach the driver, where the minimum-size check should reject it. Leave zero unchanged while rounding nonzero...

PT-2026-116673

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2 parse contexts validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose byt...

PT-2026-116731

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A use-after-free flaw exists in the drm/nouveau component. The nouveau sched destroy function calls nouveau sched fini, which invokes drm sched fini&sched-base, and subsequently releases...

PT-2026-116696

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix NULL pmu ctx passed to pmu-sched task perf pmu sched task returns early when cpuctx-task ctx is set, and cpc-task epc is only non-NULL while a task context is scheduled in on this CPU. perf pmu sched task therefore...

PT-2026-116694

In the Linux kernel, the following vulnerability has been resolved: s390/cmf: Fix virtual vs physical address confusion The measurement block address is an absolute address. Define the associated schib config and schib fields as dma64 t to enable automatic detection of incorrect assignments. Also...

PT-2026-116776

In the Linux kernel, the following vulnerability has been resolved: gve: DQO: fix header length used by gve can send tso for UDP GSO gve can send tso computes how many buffers each segment of a GSO packet would span, and for this it needs the length of the headers that the device replicates in...

PT-2026-116680

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sock: validate event length before filtering is filtered packet reads the event code from skb-data0 without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command...

PT-2026-116805

In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before mod timer in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls mod timer before taking the reference needed by th...

PT-2026-116921

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject invalid 320 MHz CSA bandwidth The HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a received CSA frame on a non-6 GHz link. It warns for this unsupported width but...

PT-2026-116793

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: stop Tx NAPI before disabling the queues bcmgenet netif stop and the Wake-on-LAN branch of bcmgenet suspend both disable the Tx queues first and stop Tx NAPI several steps later. A completion in flight calls netif ...

PT-2026-116800

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfc llcp recv dm nfc llcp recv dm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connecting sockets: it looks the socket up with nfc llcp connecting sock get...

PT-2026-116802

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach...

PT-2026-116657

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mptcp module where the mptcp write data fin function fails to initialize certain values when sending a DATA FIN without data. Because a DATA FIN occupies one octet...

PT-2026-117087

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject a kset that overruns its segment cache replay, the writeback worker and the GC worker read a kset of get kset onmedia size bytes and advance the position by it. A forged key num makes that size exceed the...

PT-2026-116759

In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraph data list when the reservation is not filled fprobe fgraph entry reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0. fgraph...

PT-2026-116822

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when clearing stale local source The UDP output fallback clears bind-local in place when the remembered source address is no longer usable. The bind is RCU-published and read locklessly by concurrent TX, so an...