PT-2026-79594

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix sk redir use-after-free in send verdict sk psock msg verdict takes a socket reference for psock-sk redir. tcp bpf send verdict copies that pointer while holding the source socket lock, but does not take a...

PT-2026-79626

In the Linux kernel, the following vulnerability has been resolved: net/sched: act ct: fix sk buff leak when the header checks reject a packet tcf ct handle fragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTO IPV4 err = tcf ct ipv4 i...

PT-2026-79653

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtw cfg80211 monitor if xmit entry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data...

PT-2026-79678

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - fix information leak in evdev pass values In evdev pass values, the input event structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. On architectures wher...

PT-2026-79622

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs-lock in dibs dev alloc dibs-lock is initialised by dibs dev add, but a dibs device can already take interrupts before that call: ism probe runs ism dev init, and hence request irq, before it calls dibs dev...

PT-2026-79720

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpf nf ct lookup and bpf nf ct alloc entry read opts-netns id separately when acquiring and...

PT-2026-79627

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aq ring rx deinit only walks sw head, sw tail, the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page and its D...

PT-2026-79708

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Validate T10 PI scatterlist counts When T10 PI is negotiated, vhost-scsi splits protection bytes from the data iterator before mapping the request scatterlists. A malformed request can claim protection bytes that cove...

PT-2026-79654

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg txt...

PT-2026-79639

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ring buffer subbuf order set frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rb advan...

PT-2026-79714

In the Linux kernel, the following vulnerability has been resolved: xsk: clear metadata pointer when no timestamp is requested User space can change metadata flags after request processing. Rereading them during completion can therefore make the kernel write a timestamp that was not requested whe...

PT-2026-79643

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Serialize the scheduler timeout handlers V3D exposes several independent hardware queues BIN, RENDER, TFU and CSD but has only a single, global reset. A timeout on any one queue therefore has to stop, reset and restart t...

PT-2026-79621

In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb shared info tailroom xdpf clone clones broadcast copies into a single page and sets frame sz to PAGE SIZE. xdp build skb from frame later treats that page like a normal XDP frame and expects th...

PT-2026-79600

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscrypt ioctl set policy fscrypt ioctl set policy calls inode owner or capable with &nop mnt idmap before allowing an encryption policy to be set, instead of the idmap of the...

PT-2026-79694

In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vcc setsockopt vcc setsockopt contained an ineffective optlen check: if SO LEVEL MATCHoptname, level && optlen != SO SIZEoptname return -EINVAL; If SO LEVEL MATCHoptname, level evaluated to...

PT-2026-79608

In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: Fix board ID over-read The EEPROM board ID is a fixed 13-byte field and is not guaranteed to contain a NUL terminator. Passing it directly to devlink info version fixed put treats it as a C string and may read beyond th...

PT-2026-79648

In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: error out for zero quota goal target values Patch series "mm/damon: avoid division by zero from damos quota score". DAMON SAMPLE MTIER and DAMON LRU SORT allow the user to trigger division by zero in damos...

PT-2026-79592

In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addip last asconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctp asconf queue teardown...

PT-2026-79673

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tpacket snd function where dev-hard header len is read independently during skb allocation and header construction within tpacket fill skb. Concurrent netdevice...

PT-2026-79641

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between update event fields and, event define fields The following sequence may leads race between event define fields and update event fields: CPU0 loads module A CPU1 loads module B...