CVE-2026-68478

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

CVE-2026-68473

In the Linux kernel, the following vulnerability has been resolved: powerpc/uaccess: correct check for CONFIGPPCE500 in maskuseraddress maskuseraddress incorrectly checks for CONFIGE500 instead of CONFIGPPCE500, causing maskuseraddressisel to not be used on E500 hardware. Fix the check to use the...

CVE-2026-68474

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufsmemmmapaccess spufsmemmmapaccess computes the local store offset as address - vma-vmstart, but bounds-checks it against vma-vmend instead of the local store size. On 64-bit, offset ...

CVE-2026-68472

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...

CVE-2026-68470

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

CVE-2026-68466

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: lpc32xxslc: fail DMA transfer on completion timeout lpc32xxxmitdma waits for the DMA completion callback but ignores waitforcompletiontimeout. A timed out DMA transfer is therefore unmapped and reported as successfu...

CVE-2026-68457

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for FSCTL mutations SETSPARSE, SETZERODATA and SETCOMPRESSION operate on an open SMB handle but call VFS xattr, fallocate or fileattr helpers with the current ksmbd worker credentials. Those helpers...

CVE-2026-68455

In the Linux kernel, the following vulnerability has been resolved: liveupdate: validate session type before performing operation The sessions ioctls are not applicable to all session types. PRESERVEFD is only applicable to outgoing sessions. RETRIEVEFD and FINISH are only valid for incoming...

drm/vc4: Prevent shader BO mappings from becoming writable

...

PT-2026-72839

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the crypto: ccp component where page allocation failures are not correctly handled in TIO. When snp alloc firmware pages returns NULL due to memory pressure, passing...

PT-2026-72788

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists where the global pointer reserved mem continues to reference the reserved mem array located in initdata if the alloc reserved mem array function fails...

PT-2026-72658

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTFS3 file system where a buffer overflow can occur when mounting a dirty NTFS volume. The log replay function initially allocates the log-one page buf buffer base...

PT-2026-72203

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the DRBD module where the recv dless read function fails to properly validate the payload size of a P DATA REPLY received from a peer. The payload length is handled as...

PT-2026-72357

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the kho component where scratch sizes specified via the command line are not rounded up to CMA MIN ALIGNMENT BYTES. While this rounding occurs when using scratch scale...

PT-2026-72896

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/vmwgfx component where the vmw cmd draw function fails to properly validate the header-size variable before performing a division operation. Because header-siz...

PT-2026-72290

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the dm-integrity component when the hash size is smaller than the device tuple size. The system fails to properly zero the remaining space, leading to the leakage...

PT-2026-72615

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the replace effective prog and purge effective progs functions incorrectly locate slots in the effective array when BPF F PREORDER programs are...

CVE-2026-72101: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix leaking uninitialized kernel memory If hash size is less than device's tuple size, dm-integrity is supposed to zero the remaining space. There was a bug in the code that zeroing didn't work. This commit fixes it...

CVE-2026-72292: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Initialize KVMS390GETCMMABITS memory kvms390getcmmabits allocates its output buffer with vmalloc, which does not zero the returned pages: values = vmallocargs-count; In the non-peek migration path, datgetcmma reports a...

CVE-2026-74416: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix memory leak in radeonringrestore on lock failure radeonringrestore takes ownership of the data buffer allocated by radeonringbackup. The caller radeongpureset only frees it in the non-restore branch; in the restor...