PT-2026-122014

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: reject the lmk IV mode with AEAD ciphers A "capi:" table line that pairs an AEAD cipher with the lmk IV mode, for example "capi:gcmaes-lmk" with the integrity:28:aead option, causes an oops when it is loaded. lmk sets...

PT-2026-122028

In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverity info fsverity get info calls rhashtable lookup fast, which just uses rcu read lock and doesn't directly synchronize with fsverity remove info. For the same inode this isn't a...

PT-2026-122047

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6 info hw flags set sizes the skb with rt6 nlmsg size and later fills it with rt6 fill node. With nexthop compatibility mode enabled, a concurrent replacement can grow the grou...

PT-2026-122052

In the Linux kernel, the following vulnerability has been resolved: rust binder: reschedule node refcount update on thread exit When a thread exits via BINDER THREAD EXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferr...

PT-2026-122006

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5 tc matchall replace allocates a struct sparx5 mall entry for every offloaded matchall filter and adds it to sparx5-mall entries. sparx5 tc matchall destroy removes the entry...

PT-2026-122043

In the Linux kernel, the following vulnerability has been resolved: can: dev: init can skb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skb reset mac header/skb reset network header/ skb reset transport header calls from...

PT-2026-122040

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let data start run past the buffer struct dm ioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dm ioctl, data, is seven bytes shorter than sizeofstru...

PT-2026-122031

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipc topsrv stop closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could...

PT-2026-122009

In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc getname smc getname dereferences smc-clcsock without holding clcsock release lock. Link-group termination can release the CLC socket through smc close active abort while the SMC socket is...

PT-2026-122019

In the Linux kernel, the following vulnerability has been resolved: io uring/net: populate CONNECT filter fields for 24-byte sockaddr in6 io connect bpf populate fills connect.port and connect.v6 addr for AF INET6 only when addr len = sizeofstruct sockaddr in6, i.e. 28 bytes. The IPv6 connect pat...

PT-2026-122025

In the Linux kernel, the following vulnerability has been resolved: gve: fix napi disable deadlock when attempting to disable XSK pools When disabling XSK pools, GVE calls the unlocked versions of napi disable and napi enable. However, the netdev lock has already been acquired before ndo bpf is...

PT-2026-122046

In the Linux kernel, the following vulnerability has been resolved: Input: ati remote2 - fix type confusion in device attribute handlers Previously, the channel mask and mode mask attributes were registered on the parent usb device via sysfs create group. When commit b20d6bf8014b "Input:...

PT-2026-122030

In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipc node find by name returns a node after dropping its RCU read lock without taking a reference. The LINK SET, LINK GET and LINK RESET STATS handlers then lock and access the...

PT-2026-122012

In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req timeout while a request is active. msdc request done uses cancel delayed work, which does not wait for a timeout callback that has already started. The...

PT-2026-122015

In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx usb ms: complete requests after eject instead of dropping them memstick check can pass its host-removing check just before rtsx usb ms drv remove sets eject/removing. Its next request is then silently dropped: rtsx...

PT-2026-122041

In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipso v4 skbuff delattr removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a...

PT-2026-122045

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify dao clear left,right input functions" centralized the DAO input mapper clearing logic in dao clear input, but omitted the...

PT-2026-122011

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhci sprd probe enables runtime PM, while sdhci sprd remove does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM before disabling the...

PT-2026-122022

In the Linux kernel, the following vulnerability has been resolved: ibmveth: h free logical LAN on open-fail after register ibmveth open registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out free buffer pools without h free logical lan, so PHYP still owns the...

PT-2026-122036

In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thread, A, runs. While it's running, the second one, B, gets partw...