PT-2026-121935

In the Linux kernel, the following vulnerability has been resolved: btrfs: always return -EIOCBQUEUED after btrfs uring read extent endio If all bios finish before btrfs encoded read regular fill pages returns, it calls btrfs uring read extent endio and previously returned the I/O status. A...

PT-2026-121910

In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to request irq With commit ba268514ea14 "rust: devres: fix race condition due to nesting", Devres::new returns Result by value instead of initializing in-place via PinInit. Because...

PT-2026-121936

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvmet req alloc p2pmem sgls function where req-p2p dev is assigned only after both data and metadata SGL Scatter Gather List allocations succeed. If data allocatio...

PT-2026-121951

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch containing an incomplete description of a bug in XFS IOC EXCHANGE RANGE's TO EOF flag. The bug tricks exchange-range into modifying a file so that it...

PT-2026-121917

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the HID steam component during the teardown sequence. A narrow timing window allows callbacks to be scheduled during cleanup, resulting in a dangling pointer to the free...

PT-2026-121920

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum flower: Fix port range register leak in tmplt create mlxsw sp flower tmplt create parses a flow cls offload template into a stack-local struct mlxsw sp acl rule info purely to compute rulei.values.elusage. Parsing...

PT-2026-121912

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID is a hardware port ID and is not necessarily the index of the corresponding entry in variant-dai driver. When configuring a DAI with LPAIF I2SCTL MODE...

PT-2026-121925

In the Linux kernel, the following vulnerability has been resolved: devlink: fix devlink rel reference leak when notify work is pending devlink rel nested in notify work schedule takes a reference on the devlink rel for the notify work and then queues the work, ignoring the return value of schedu...

PT-2026-121933

In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when io uring read extent fails btrfs uring read extent runs only after btrfs encoded read has taken the inode shared lock and the extent lock. On failure it used to unlock in out fail, an...

PT-2026-121928

In the Linux kernel, the following vulnerability has been resolved: ASoC: adau1372: allow sleepy powerdown GPIOs gpiod set value emits a WARN when the GPIO provider indicates that it can sleep, as is typical for I2C controlled GPIO expanders. Since the powerdown GPIO is only manipulated in proces...

PT-2026-121931

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfs dir item item that packs multiple xattrs and then we replace the value of one of them with the setxattr2 family of syscalls with another...

PT-2026-121926

In the Linux kernel, the following vulnerability has been resolved: net: always dissect GSO packets in virtio net hdr to skb Commit 9e8db5913264 "net: avoid false positives in untrusted gso validation" added a '&& skb-network header' check before flow-dissecting GSO packets without VIRTIO NET HDR...

PT-2026-121923

In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin user regset copyin only copies count bytes, so a PTRACE SETREGSET request with a short iov len leaves the rest of the stack buffer uninitialized. In riscv vr set that...

PT-2026-121914

In the Linux kernel, the following vulnerability has been resolved: sched ext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes the global pointers before filling them, ops.init cids overrides...

PT-2026-121919

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmci transport recv dgram cb During the closure of a datagram socket, the vmci transport recv dgram cb function may be called, which will add the packets to the socket's backlog; then, after the receive...

PT-2026-121938

In the Linux kernel, the following vulnerability has been resolved: bonding: fix the program leak when XDP is replaced We need to release the reference on the old BPF prog, whether we are going to no-prog, or replacing the prog with another. Spotted by AI while running tests for the propagation...

PT-2026-121921

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vm bo handling in remap When a map overlaps part of an existing mapping, pvr vm gpuva remap splits the mapping into prev/next parts covering what the request did not take, instead of creating...

PT-2026-121924

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the PFCP Packet Forwarding Control Protocol implementation where pfcp encap recv fails to ensure that the 8-byte Session Endpoint Identifier SEID is in the linear area...

PT-2026-121916

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the HID steam component where the code for unregistering a battery was omitted during a previous refactor if subsequent registration steps failed. This flaw allows a...

PT-2026-121911

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Drop unnecessary PMD page copy when freeing On a box with a discrete GPU, lockdep reports a possible deadlock as soon as kswapd shrinks the TTM page pool. The immediate cause is an x86 commit that added an mmap read lock ...