PT-2026-121858

In the Linux kernel, the following vulnerability has been resolved: arm64: kprobes: Allow reentering kprobes while single-stepping A kprobe can be hit while another kprobe is in KPROBE HIT SS state. This can happen when tracing or perf code runs from the debug exception path while the first kprob...

PT-2026-121865

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/mlx5 HWS component where deleting a table that has a miss table created via the mlx5hws table set default miss function does not properly remove the table from...

PT-2026-121870

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntalloc ioctl alloc allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so...

PT-2026-121960

In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switch task namespaces and copy namespaces and dropped...

PT-2026-121843

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack expect: zero at allocation time There are occasional LLM hints wrt. leaking uninitialized data to userspace via ctnetlink. Just zero at allocation time, expectations are not frequently used these days...

PT-2026-121900

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Derive GUEST HAS SVE from the SVE feature bit at EL2 pkvm init features from host takes KVM ARCH FLAG GUEST HAS SVE and KVM ARM VCPU SVE from the host separately, but pkvm vcpu init sve tests the bit while vcpu has sv...

PT-2026-121896

In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evict inodes We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fs bdev mark dead calls evict inodes while...

PT-2026-121897

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copied seq double-counting When a BPF stream verdict program redirects an skb back to the same socket self-redirect with BPF F INGRESS, sk psock verdict apply calls tcp eat skb which advances tcp...

PT-2026-121905

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and...

PT-2026-121907

In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtc wkalrm to prevent information leak The struct rtc wkalrm has padding holes after the 'pending' member. When returned to userspace via the RTC WKALRM RD ioctl, uninitialized kernel stack data...

PT-2026-121909

In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf event open currently gates perf allow kernel only on !attr.exclude kernel. However, users can still request kernel callchain collection with attr.exclude...

Linux kernel Resource Control Compromise

The vulnerability of the Linux operating system’s kernel is related to insufficient control over resources during its existence. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information...

Linux kernel DoS

The vulnerability of the r8712initxmitpriv function in the drivers/staging/rtl8712/rtl871xxmit.c file and the r8712xmitresourcealloc function in the drivers/staging/rtl8712/xmitlinux.c file of the Linux kernel is related to insufficient resource management during its existence. Exploiting this...

Red Hat: CVE-2026-98873: kernel: netfilter: nf_conntrack_expect: zero at allocation time

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackexpect: zero at allocation time There are occasional LLM hints wrt. leaking uninitialized data to userspace via ctnetlink. Just zero at allocation time, expectations are not frequently used these days...

PT-2026-121872

In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bm seq comparison wrap-safe Once the 32-bit seq wraps, a newer bm seq can look smaller than old, so .. covert to wrap-safe calculate way...

PT-2026-121877

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb write pointer with invalidate lock sb write pointer reads the super block from the block device page cache using read cache page gfp. This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568...

PT-2026-121895

In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremap prot Mapping a stack-top page via /dev/mem with PROT NONE and then reading that process's /proc//cmdline triggers a spurious WARN in ioremap prot through generic access phys:...

PT-2026-121847

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed When accidentally setting “kvm-arm.vgic v4 enable=1” on a system that has no MSI controller device tree node and GICv4, it results a panic as “gic domain” is NULL and the...

Red Hat: CVE-2026-98871: kernel: crypto: ccp - Fix possible deadlock in SEV init failure path

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix possible deadlock in SEV init failure path sevplatforminithandleinitexpath calls rmpmarkpagesfirmware with locked=false while the parent function of initexpath already acquired the sevcmdmutex. In the case of an...

PT-2026-121974

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpu userq get doorbell index pins any BO passed as doorbell handle into the doorbell domain. For a regular BO, TTM moves it with ttm bo move null and its contents ar...