PT-2026-121908

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar-num stations on hardware start When multiple hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'num stations' in 'struct ath11k' that did not...

PT-2026-121934

In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfs uring read extent fails After btrfs uring read extent, the caller always jumped to out acct. That skips kfreedata-iov, which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On...

PT-2026-121966

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops do loopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own fil...

PT-2026-121988

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise sco conn lifetime against sco recv scodata sco recv scodata upgrades the weak hcon-sco data back-pointer to a strong reference under hdev-lock: hci dev lockhdev; hcon = hci conn hash lookup handlehdev,...

PT-2026-122000

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from of regulator bulk get all of regulator bulk get all allocates the consumers array and hands it to the caller, who is expected to free it at an appropriate time. pwrseq-pcie-m2.c...

PT-2026-122003

In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bc transmit sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but team xmit still returns NETDEV TX OK. ...

PT-2026-121977

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xe bo pin external and xe bo unpin external support nested pins, since the underlying ttm bo pin/ttm bo unpin maintain a pin count refcount rather than a...

PT-2026-121984

In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: defer setup when fbdev probe fails, not just on -EAGAIN drm fb helper initial config and unlock calls drm client modeset probe first, which already fills in each mode set-mode/num connectors for every connected...

PT-2026-121963

In the Linux kernel, the following vulnerability has been resolved: namespace: remove the fsnotify marks of a mount namespace in process context mnt ns release drops the last passive reference of a mount namespace and removes its fanotify marks via fsnotify mntns delete. That takes the mutex of...

PT-2026-121993

In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access access ok checks untagged addruaddr, but arch futex atomic op inuser and futex atomic cmpxchg inatomic hand the raw uaddr to the inline asm amoswap/amoadd/.../lr.w+sc....

PT-2026-121998

In the Linux kernel, the following vulnerability has been resolved: regulator: of: fill in supply names in of regulator bulk get all of regulator bulk get all returns an array it allocated itself, and fills in only the consumer of each entry. Every other way of getting a bulk array has the supply...

PT-2026-122001

In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized optee probe called tee device register on both the client and the supplicant device before the rest of struct optee had been initialized. tee device register calls cdev devi...

PT-2026-121990

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup iso sock listen drops the socket lock before calling iso listen bis to preserve the hdev-lock ordering. Two concurrent listen calls on the same broadcast socket can therefore...

PT-2026-121982

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intel rps boost reading a stale ACTIVE state and queuing rps-work, where ACTIVE may be changed via asynchronous calls triggered by waker...

PT-2026-121967

In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrink submounts and mark mounts for expiry first collect all the mounts they are allowed to unmount and then unmount them. Whether a mount is busy is decided ...

PT-2026-121991

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: Fix command skb lifetime during scan setup During PA sync scan setup, hci le set ext scan param sync gets the address used for the PA LINK lookup from hci sent cmd data. The returned pointer borrows storage...

PT-2026-121979

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...

PT-2026-121958

In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink, rmdir and rename remove the entry from the filesystem, call detach mounts on the entry with the inode locked and then call d delete once the inode is unlocked...

PT-2026-121973

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate mount busy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

PT-2026-121972

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mnt change mountpoint umount mnt resets -overmount of the parent when it unmounts the mount that overmounts it. mnt change mountpoint doesn't. It moves the mount to its new parent a...