PT-2026-121979

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...

PT-2026-121958

In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink, rmdir and rename remove the entry from the filesystem, call detach mounts on the entry with the inode locked and then call d delete once the inode is unlocked...

PT-2026-121999

In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST 0x1e and CLIRQ 0x1f are write-only command strobes. Writing HRST triggers a hard reset of the chip and writing CLIRQ clears the interrupt; reading them...

PT-2026-121973

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate mount busy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

PT-2026-121972

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mnt change mountpoint umount mnt resets -overmount of the parent when it unmounts the mount that overmounts it. mnt change mountpoint doesn't. It moves the mount to its new parent a...

PT-2026-121980

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthor drv.c:panthor ioctl group create, the queue count is validated against the hardcoded maximum: if !args-queues.count || args-queues.cou...

PT-2026-121995

In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIG SHADOW CALL STACK, handle exception reloads the kernel shadow call stack pointer gp only when the trap came from userspace. It made that decision wit...

PT-2026-121987

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcomm recv data hands the skb to d-data ready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the...

PT-2026-121957

In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. step into step into rechecks d seq and follow mount rcu rechecks mount lock. An entry that gets unlinked in between caus...

PT-2026-121992

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hci sock bind clears hci pisk-hdev and drops the device...

PT-2026-121965

In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPEN TREE NAMESPACE open treeOPEN TREE NAMESPACE creates a new mount namespace from a copy of the tree at the given path. The caller needs to be privileged over its current user namespace...

PT-2026-121962

In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivot root path pivot root reads the parents of new root and of the caller's root and checks whether they are shared before it checks that either mount is in the caller'...

PT-2026-121983

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for eb relocate parse slow to call kvfree on entries outside the original exec array during following scenario inside eb relocate parse slow: 1 eb copy...

PT-2026-122004

In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero dev queue xmit result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port or the mode transmi...

PT-2026-121994

In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCV ALTERNATIVE EARLY for THEAD GHOSTWRITE errata probe ghostwrite only marks the CPU as vulnerable when it is called at the RISCV ALTERNATIVES EARLY BOOT stage, and the mitigation in ghostwrite enable...

PT-2026-121959

In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount d alloc pseudo hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHE NORCU and dentry free frees them righ...

PT-2026-121997

In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594-regulator: Fix n linear ranges for TPS65224 BUCK2-4 The TPS65224 BUCK2, BUCK3 and BUCK4 descriptors pass 4 as n linear ranges, but tps65224 bucks 2 3 4 ranges only has two entries, covering selectors 0x00-0x45...

PT-2026-121971

In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mount lock statmount mnt basic reads the ids of the parent through m-mnt parent with namespace sem held for reading. That's fine for a mount that is in a namespace. Everythin...

PT-2026-121981

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 "drm/imagination: Fix page count for page table for map interface" passed the device address to pvr mmu op context create, but the preallocation...

PT-2026-121986

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcomm mutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...