PT-2026-72848

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the rtw88 wifi driver, an issue exists where an ieee80211 hw pointer is stored via pci set drvdata during probe time, but the io error detected and io resume functions retrieve it as ...

CVE-2026-72180: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: preserve pmdswpuffdwp on device-private PMD downgrade changenonpresenthugepmd rewrites a writable device-private PMD swap entry into a readable one without carrying pmdswpuffdwp across. The PTE-level...

PT-2026-72286

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the dm-verity component. This occurs within the dm verity loadpin is bdev trusted function when a device does not have a table. Recommendations At th...

PT-2026-72360

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the memory management initialization where section activate reuses the unoptimized boot memmap when DAX memory is hotplugged into an unoccupied subsection of an early...

PT-2026-72664

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the dmaengine component. In the dma release channel function, the system checks chan-device-privatecnt after calling dma chan put. Because dma chan put...

PT-2026-72739

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the qca dmp hdr function when handling hci uart attached via non-serdev paths. The issue arises because the function unconditionally attempts to acce...

PT-2026-72672

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double free issue exists in the video registration process within the staging area. The function comp register videodev allocates a video device using video device alloc and attempts t...

PT-2026-72674

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the mtk-adsp mailbox component during device teardown. When the SOF audio driver fails to initialize, the snd sof dev object is freed. However, becau...

PT-2026-72547

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bo meminfo When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle...

PT-2026-72972

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the iommu/iommufd component. The iopf group alloc function links last-page IOPF groups into a generic pending list. Simultaneously, iommufd fault iop...

PT-2026-72291

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dm early create function where the kernel incorrectly attempts to free a table using the dm table destroy function if dm resume fails. This occurs because the tabl...

PT-2026-72268

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free and double-free issue exists in the ims pcu disconnect function. The function is designed to perform cleanup only when the primary control interface is unbound, but it...

PT-2026-72335

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dw-edma-pcie component of the dmaengine. The dw edma pcie probe function unconditionally copies the PCI device ID driver data to use as a template for the controll...

PT-2026-72520

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the Linux kernel when the function amdxdna hwctx sync debug bo invokes the hardware hwctx sync debug bo callback while holding the xdna-dev lock lock. This callback...

PT-2026-72448

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the MT8192 AFE probe, runtime Power Management PM is enabled temporarily during the reinitialization of the regmap cache from hardware. The process uses the pm runtime get sync functi...

PT-2026-72359

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mtd: slram component where the register device function links a new slram mtdlist entry before all required state is allocated. If a subsequent allocation, memrema...

PT-2026-72951

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap out-of-bounds write exists in the ALSA usb-audio component. The function snd usbmidi akai output calculates a loop bound using a signed integer. If a USB device advertises a very...

PT-2026-72791

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommu/vt-d component where the info-node RB-tree member is zero-initialized via kzalloc. When a device does not support ATS Address Translation Services, the devic...

PT-2026-72254

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mana network driver where the system fails to validate the packet length reported in the RX CQE Completion Queue Entry before passing it to skb socket buffer...

CVE-2026-72255: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: pin bridge device while NFQUEUE holds fake dst The brnetfilter fake rtable is embedded in struct netbridge and is attached to bridged packets with skbdstsetnoref. If such a packet is queued to NFQUEUE, nfqueue...