PT-2026-116915

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix driver deregistration order USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus. When unloading a driver module, the USB driver must be...

PT-2026-116927

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replace ctx pointers between the old WILL BE REPLACED chanctx and the new REPLACES OTHER chanctx. However, the early free paths only consider...

PT-2026-116923

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep fallback association elements alive Associating to a non-transmitted MBSSID profile reads freed memory while determining the operating channel and applying HT capabilities. When an association response omits...

PT-2026-116982

In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both ep in and ep out for non-ep0 control endpoints In usb enable endpoint, non-zero control endpoints where usb endpoint xfer control&ep-desc is true populate both dev-ep inepnum and dev-ep outepnum with the sam...

PT-2026-116967

In the Linux kernel, the following vulnerability has been resolved: serial: 8250 bcm7271: fix use-after-free in brcmuart remove brcmuart handle irq starts priv-hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuart hrtimer fu...

PT-2026-116968

In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100 shutdown stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, the serial core does not call max3100 shutdow...

PT-2026-116780

In the Linux kernel, the following vulnerability has been resolved: nfp: hold IPsec RX state under the XArray lock nfp net ipsec rx drops the XArray lock before taking a reference to the xfrm state it found. The delete path can erase the entry and drop the last state reference in that interval. R...

Linux Distros Unpatched Vulnerability : CVE-2026-98662

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: light: gp2ap020a00f: drain irqwork after freeirq The threaded IRQ handler queues data-work through irqworkqueue so the trigger is polled from a per-CPU...

AlmaLinux 10 : kernel (ALSA-2026:83207)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:83207 advisory. kernel: netfilter: nfnetlinkqueue: do shared-unconfirmed check before segmentation CVE-2026-45859 kernel: net/sched: actct: Only release RCU read lock...

PT-2026-116959

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Drop init from ECC setup paths for re-probe safety Sashiko reports: "Does suppressing sysfs unbinding fully prevent the execution of freed init memory? If altr sysmgr regmap lookup by phandle returns -EPROBE DEFER, t...

PT-2026-116691

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Free have run cpus during VM destruction even if VM is no longer SEV Unconditionally free SEV's "have run CPUs" cpumask in the VM destroy path, i.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV...

PT-2026-117008

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in free by rcu ttrace do call rcu ttrace returns early when call rcu ttrace in progress is set and leaves the objects in free by rcu ttrace. free rcu frees waiting for gp ttrace only and clears the flag...

PT-2026-116752

In the Linux kernel, the following vulnerability has been resolved: ipe: protect the dm-verity root hash with RCU ipe bdev setintegrity frees the old root hash when dm-verity publishes a new one on -preresume, while policy evaluation can still be dereferencing it. Protect the root hash with RCU...

PT-2026-116767

In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled ERRORStale CookieDATA packet from one of its non-primary addresses, processing the ERROR chun...

PT-2026-116844

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish HW DEAD after worker is done flow offload work del sets NF FLOW HW DEAD before the work handler clears NF FLOW HW PENDING. Once a flow is both HW DYING and HW DEAD, a concurrent garbage collection pa...

PT-2026-116851

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending mesh send sync entries on cancel In send cancel, pending mesh tx objects are removed from the hdev-mesh pending list and freed via mesh send complete. However, if a mesh transmission was already...

PT-2026-116889

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind The ZYNQ XADC alarm IRQ handler queues zynq unmask work via schedule delayed work; that work is cleared by a devm callback. Register the devm callback...

PT-2026-116896

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad sigma delta: fix use-after-free on unbind ad sd buffer postenable allocates sigma delta-samples buf with devm krealloc at runtime, so its devres entry sits after all probe-time entries of the driver. devm resources a...

PT-2026-116918

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF mesh fast tx cache stores raw mesh path pointers. Path deletion flushes the cache and then frees the path with kfree rcu, but a lookup that already holds the path can insert a...

PT-2026-116953

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci core: Serialize SCO and ISO scheduling with teardown hci low sent selects a connection under RCU but drops the read lock before calculating its quota and returning it to the scheduler. The connection is then used...