PT-2026-72478

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix GISC refcount leak on AIF enable failure kvm s390 gisc register registers the guest ISC before pinning the guest interrupt forwarding pages and allocating the AISB bit. If any of the later setup steps fails, t...

PT-2026-72734

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix FRMR set pinned push error path Add destruction of FRMR handles in case the push to the pool fails. This prevents resources leak in case pool page allocation fails...

PT-2026-72667

In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: handle I2C read errors in mma8452 read Currently, If i2c smbus read i2c block data fails but mma8452 set runtime pm state succeeds, mma8452 read returns 0. As a result, the caller mma8452 read raw assumes the...

PT-2026-72568

In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response req id before indexing rsp pvcalls front event handler takes req id directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a stor...

PT-2026-72598

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Validate NIX maximum LFs correctly NIX maximum number of LFs can be set via devlink command but that can be done before assigning any LFs to a PF/VF. The condition used to check whether any LFs are assigned is...

PT-2026-72804

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12k wifi7 dp rx h verify tkip mic In ath12k wifi7 dp rx h verify tkip mic, the call to ath12k dp rx check nwifi hdr len valid may return false when the NWIFI header length is invalid, causing t...

PT-2026-72762

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix resource leak in probe error path When pcim iomap region or devm kmemdup fail, the code returns directly without cleaning up previously allocated resources: - mt76 device allocated by mt76 alloc device - p...

PT-2026-72533

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback On failure at index i, the reverse cleanup loop in mlx5 lag create single fdb starts from i, so the failed index itself is rolled back. That can operate on uninitialized...

PT-2026-72452

In the Linux kernel, the following vulnerability has been resolved: fbdev: tridentfb: fix potential memory leak in trident pci probe In trident pci probe, the memory allocated for modelist using fb videomode to modelist is not freed in subsequent error paths. Fix that by calling fb destroy modeli...

PT-2026-72618

In the Linux kernel, the following vulnerability has been resolved: net/sched: act ct: fix nf connlabels leak on two error paths tcf ct fill params calls nf connlabels get setting put labels when TCA CT LABELS is present, but two later error sites use a bare return instead of "goto err", skipping...

PT-2026-72276

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfc sli4 driver resource setup The memory allocated for mboxq using mempool alloc is not freed in some of the early exit error paths. Fix that by moving the mempool free call to an earlier point...

PT-2026-72549

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hw engine: Fix double-free of managed BO in error path The error path in hw engine init explicitly frees a BO allocated with xe managed bo create pin map via xe bo unpin map no vm. Since the managed BO already has a devm...

PT-2026-72971

In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: don't free uninitialized dev name on error path dt remember or free map duplicates dev name for each map entry. If kstrdup const fails, dt free map frees dev name in all num maps entries, including entries th...

PT-2026-72228

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix potential memory leak in bnx2x alloc mem bp If the allocation of fpi.tpa info fails, the error path will not free the struct bnx2x fastpath allocated earlier, as it is not linked to the bp structure yet. Fix that by...

PT-2026-72193

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix memory leak in ieee80211 register hw If kmemdup fails while copying supported band structures, the error path jumps to fail rate. This skips rate control deinitialize and leaks the initialized local-rate ctrl...

PT-2026-72418

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: free unfragmentable packet The caller of batadv frag send packet assume that the skb provided to the function are always consumed. But the pre-check for an empty payload or the zero fragment size returned an err...

PT-2026-72460

In the Linux kernel, the following vulnerability has been resolved: fbdev: radeon: fix potential memory leak in radeonfb pci register The function radeonfb pci register allocates memory for modelist by calling radeon check modes which calls fb add videomode. The memory is appended to info-modelis...

PT-2026-72831

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5 IB METHOD DEVX SUBSCRIBE EVENT links event sub into sub list before initializing the fields used by the shared error path. If eventfd ctx fdget then fails, the unwi...

PT-2026-72566

In the Linux kernel, the following vulnerability has been resolved: afs: Fix error code in afs extract vl addrs The error codes on these paths are only set on the first iteration through the loop. Set the correct error code on every iteration...

PT-2026-72552

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix writeback error handling Fix the error handling in writeback iter loop. If an error occurs, writeback iter needs to be called again with error set to the error so that it can clean up iteration state. Further, the...