PT-2026-98720

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the persistent ring buffer validation where the system uses the nr subbufs variable without verifying that it matches the expected value of nr pages + 1. This lack of...

PT-2026-98785

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A remote denial of service and an out-of-bounds read exist in the SCTP implementation. The function sctp verify asconf uses sctp walk params to advance through ASCONF-ACK parameters usin...

PT-2026-98798

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the NTFS driver. The function ntfs attr find in attrdef iterates through the in-memory $AttrDef table, but the loop condition only validates the start of...

PT-2026-98811

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem regarding per-CPU map updates for array, hash, and cgroup storage maps when BPF F CPU or BPF F ALL CPUS are not used. The syst...

PT-2026-98817

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read issue exists in the resp worker function within the accel/qaic component. This occurs because the logic for handling DBC deactivation skipped the bounds checking co...

PT-2026-98820

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ppp async component where the process input packet function incorrectly resets a reused socket buffer skb headroom to zero during a frame-error path. This violates...

PT-2026-98475

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write exists in the scsi qla2xxx driver. The qla25xx ctrlvp iocb function calculates a map index using the vp index variable and writes to the vp idx map array without...

PT-2026-98575

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the accel: ethosu component where userspace can set the job SRAM size to 0 while maintaining SRAM accesses in the command stream. This causes the system to skip settin...

PT-2026-98577

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ethosu accelerator where the command stream might not end with a stop operation. Although the QSIZE register is intended to prevent out-of-bounds access to the...

PT-2026-98579

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the accel/ivpu component where the name field within the vpu tracing buffer header structure is a fixed-size array populated by the NPU firmware. Because the host side...

PT-2026-98580

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the accel/ivpu component where tracing log headers parsed by the fw log print buffer function reside in DMA-shared Buffer Objects BOs writable by the NPU firmware...

PT-2026-98581

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ivpu to cpu addr function where the full buffer range is not validated. This can be addressed by adding a size parameter to the function to ensure that the entire...

PT-2026-98584

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tracing component where the print entries function uses the n entries variable to store both the number of sort entries and the function's return value. When a...

PT-2026-98590

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the UFS file system where the ufs read cylinder function copies the cylinder group index and rotor positions from the on-disk group and caches them without validation...

PT-2026-98594

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA usbusx2y component where a size mismatch occurs between the in04 last array and the in04 buf buffer. The in04 last array in struct usx2ydev is declared with a...

PT-2026-98595

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA us122l driver where the hwdep mmap callback fails to clear the VM MAYWRITE flag on read-buffer mappings created with PROT READ, even after rejecting initially...

PT-2026-98640

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where the btintel pcie submit rx work function reads the packet len variable from rfh hdr without verifying if it exceeds the RX buffer size. A...

PT-2026-98655

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vdpasim blk check range function where it logs an invalid start sector but continues validating the request. This leads to an unsigned capacity subtraction...

PT-2026-98658

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vhost/vdpa component where the vhost vring set num function accepts any non-zero power-of-two queue size fitting in 16 bits and passes it to set vq num without...

PT-2026-98659

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the virtio console component where the free buf function reads past the ports device object when a control message remains on the c ovq during device unbinding. This...