PT-2026-122046

In the Linux kernel, the following vulnerability has been resolved: Input: ati remote2 - fix type confusion in device attribute handlers Previously, the channel mask and mode mask attributes were registered on the parent usb device via sysfs create group. When commit b20d6bf8014b "Input:...

PT-2026-122030

In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipc node find by name returns a node after dropping its RCU read lock without taking a reference. The LINK SET, LINK GET and LINK RESET STATS handlers then lock and access the...

PT-2026-122012

In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req timeout while a request is active. msdc request done uses cancel delayed work, which does not wait for a timeout callback that has already started. The...

PT-2026-122045

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify dao clear left,right input functions" centralized the DAO input mapper clearing logic in dao clear input, but omitted the...

PT-2026-122022

In the Linux kernel, the following vulnerability has been resolved: ibmveth: h free logical LAN on open-fail after register ibmveth open registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out free buffer pools without h free logical lan, so PHYP still owns the...

PT-2026-122036

In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thread, A, runs. While it's running, the second one, B, gets partw...

PT-2026-122016

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstick alloc card and memstick set rw addr, wait for completion timeout is used to wait for device identification and address configuration requests to complete...

PT-2026-122029

In the Linux kernel, the following vulnerability has been resolved: selinux: preserve NATIVE LABELS on already-initialized sb in set mnt opts When an NFSv4 filesystem exported with security label is mounted a second time, sget fc returns the existing superblock and nfs get root calls security sb...

PT-2026-122021

In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup ice dealloc dynamic port uses dyn port-vsi-idx to erase the dynamic port from pf-dyn ports. However, it frees the VSI before reading the index for the erase, resulting in a...

PT-2026-122053

In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an exception is only created in the IPv6 exception cache if the...

PT-2026-122026

In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pm runtime get sync leaves the usage counter incremented even when it fails, and xgpio request returns the error without dropping it. gpiolib does not call -free when -reque...

PT-2026-122037

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global...

PT-2026-122008

In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup br multicast sg del exclude ports removes automatically added STAR EXCL port groups by calling br multicast del pg. For S,G entries, that deletion calls back into br multicast s...

PT-2026-122048

In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added asynchronous route notifications for hardware flag changes. fib alias hw flags set siz...

PT-2026-122044

In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix local root reference leak in scrub print warning inode When paths from inode fails, scrub print warning inode jumps to err without dropping the reference taken by btrfs get fs root, leaking a reference to the ro...

PT-2026-122013

In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in do resume When do resume calls dm table get modenew map, the call is done without holding any locks it only holds a reference to the md. It may be possible that another concurrent ioctl on the same...

PT-2026-122023

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the buf state and its attached buffer should be freed. In the case of AF XDP ZC, the XSK buffer was not freed, leading to a...

PT-2026-122032

In the Linux kernel, the following vulnerability has been resolved: tcp: reject net iov in zerocopy receive mapping hints After copying a readable prefix, receive fallback to copy asks tcp zerocopy set hint for skb where page mapping can resume. If the next skb is unreadable, find next mappable...

PT-2026-122027

In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio mpsse irq enable arms the poll worker before publishing it: schedule work runs before the worker is added to priv-workers. If gpio mpsse disconnect walks the list in that...

PT-2026-122010

In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packet rcv spkt packet rcv spkt restores the link layer header with skb pushskb, skb-data - skb mac headerskb; That subtraction is only meaningful when the device actually has a link layer...