PT-2026-72582

In the Linux kernel, the following vulnerability has been resolved: hwmon: aspeed-g6-pwm-tach Guard fan RPM calculation against divide-by-zero Sashiko reports: In the aspeed-g6-pwm-tacho driver, the aspeed tach val to rpm function calculates the fan RPM using the tachometer value. However, it doe...

PT-2026-72589

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insn aux data leak on verifier err free env path When bpf check allocates env-insn aux data successfully but later fails to allocate env-succ, it jumps directly to err free env. The existing vfreeenv-insn aux data sits...

PT-2026-72605

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: Validate iph-ihl in nf flow ip4 tunnel proto Add sanity check for iph-ihl field in nf flow ip4 tunnel proto before using it to compute the header size, avoiding out-of-bounds access with malformed IP headers...

PT-2026-72578

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch teql: Introduce slaves lock to avoid race condition and UAF The teql master-slaves singly linked list is not protected against multiple writes. It can be mod'ed concurently from teql master xmit, teql dequeue, teql...

PT-2026-72563

In the Linux kernel, the following vulnerability has been resolved: afs: Fix reinitialisation of the inode, in particular -lock work It seems that initalising afs vnode::lock work a single time in the slab's init function isn't sufficient for work structs. This results in the DEBUG OBJECTS...

PT-2026-72573

In the Linux kernel, the following vulnerability has been resolved: tracing/fprobe: Fix NULL pointer dereference in fprobe fgraph entry fprobe fgraph entry sizes a shadow-stack reservation in one walk of the per-ip fprobe list and fills it in a second walk, both under rcu read lock only. A fprobe...

PT-2026-72567

In the Linux kernel, the following vulnerability has been resolved: fs: refuse O TMPFILE creation with an unmapped fsuid or fsgid vfs tmpfile never checked that the caller's fsuid and fsgid map into the filesystem. On an idmapped mount whose idmapping does not cover the caller's fsu,gid, the...

PT-2026-72595

In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in geneve gro complete Even with both paths gated on gs-gro hint, geneve gro complete re-derives the inner dispatch type and length from the packet and the current gs-gro hint, independently ...

PT-2026-72581

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: don't cache shinfo across skb realloc fbnic tx lso calls skb cow head which may reallocate the skb including the shared info. We can't use the pointer calculated before the call. BUG: KASAN: slab-use-after-free in fbn...

PT-2026-72564

In the Linux kernel, the following vulnerability has been resolved: afs: Fix misplaced inc of net-cells outstanding Fix net-cells outstanding being incremented before the check for failure of idr alloc cyclic, leaving the count incremented on error...

PT-2026-72593

In the Linux kernel, the following vulnerability has been resolved: net: udp tunnel: prevent double queueing in udp tunnel nic device sync Yue Sun reported a use-after-free and debugobjects warning in udp tunnel nic device sync work during concurrent device operations. The workqueue core clears t...

PT-2026-72574

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced A group ref is tied to the pending tiler oom work, so we need to release it if the cancel was effective...

PT-2026-72584

In the Linux kernel, the following vulnerability has been resolved: hwmon: adm1275: Prevent reading uninitialized stack While adding support for the ROHM BD127X0 hot-swap controllers, sashiko reported an error in device-name comparison, which can lead to reading uninitialized stack memory. Quotin...

PT-2026-72590

In the Linux kernel, the following vulnerability has been resolved: bpf: Mask pseudo pointer values in verifier logs print bpf insn masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPF PSEUDO MAP FD and BPF PSEUDO MAP VALUE...

PT-2026-72599

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: fix use-after-free of DSA ports in crc err work Upon an MDIO CRC error mxl862xx crc err work fn walks the DSA ports and closes the CPU port conduits: dsa switch for each cpu portdp, priv-ds dev closedp-conduit...

PT-2026-72629

In the Linux kernel, the following vulnerability has been resolved: ieee802154: fix kernel-infoleak in dgram recvmsg KMSAN reported a kernel-infoleak in move addr to user: BUG: KMSAN: kernel-infoleak in instrument copy to user include/linux/instrumented.h:131 inline BUG: KMSAN: kernel-infoleak in...

PT-2026-72738

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci core: Fix UAF in hci unregister dev hci unregister dev does not disable cmd timer and ncmd timer before the hci dev structure is freed. If a timeout fires during device teardown, the callback dereferences freed...

PT-2026-72648

In the Linux kernel, the following vulnerability has been resolved: apparmor: check label build before no new privs test aa change profile builds a replacement label with fn label build in scope before the no new privs subset check. The build helper can fail and return NULL or an ERR PTR, but the...

PT-2026-72619

In the Linux kernel, the following vulnerability has been resolved: alloc tag: fix use-after-free in /proc/allocinfo after module unload allocinfo start only reinitializes the codetag iterator at position 0. For subsequent reads position 0, it reuses cached iterator state from the previous batch...

PT-2026-72624

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use test bit in lockless RCU readers in hash types Sashiko pointed out that there are a few lockless RCU readers using test bit which is a relaxed atomic operation and provides no memory barrier guarantees...