PT-2026-121876

In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966x fdma reload backs up rx-page pool and rx-fdma before reallocating the RX resources for the new MTU. If the allocation fails, the restore path puts these fields back before...

PT-2026-121857

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211 hwsim: reject undersized HWSIM ATTR TX INFO hwsim tx info frame received nl casts the HWSIM ATTR TX INFO payload to a struct hwsim tx rate and unconditionally reads IEEE80211 TX MAX RATES entries 8 bytes from it. T...

PT-2026-121871

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix lease break and ack state handling Do not skip valid lease states containing WRITE CACHING when breaking level-II/read leases for writes and truncates. Handle lease break acknowledgments according to the SMB2 rule that...

PT-2026-121892

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef "netfs: Fix folio queue ENOMEM in writeback by adding a mempool" added a mempool for the folio queues and made the request, subrequest and folio...

PT-2026-121861

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211 rx mgmt deauth reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame...

PT-2026-121874

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devm pm runtime enable sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pm runtime enable into the removal path instead doing it early. This...

PT-2026-122430

Summary Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's url.Values.Get returns only the first value...

ROS-20261023-73-0211

The vulnerability in the kernel-lt is related to insufficient control of resources with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-122042

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guarantee active cpus With commit 2125c0034c5d "cgroup/cpuset: Make cpuset hotplug processing synchronous", the cpuset hotplug operation becomes synchronous. That commit also removes the...

PT-2026-121969

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree may copy tree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no...

PT-2026-121869

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter ipset component regarding the improper marking of RCU Read-Copy-Update locked areas. Specifically, the RCU lock is unnecessarily held when incrementing t...

PT-2026-121854

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided max segs The max segs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmc alloc sg to call kmalloc obj...

PT-2026-121846

In the Linux kernel, the following vulnerability has been resolved: host1x: bus: Fix missing ops null check in error teardown In host1x device init, the error teardown paths do not check client-ops before dereferencing it, unlike the forward init paths which correctly guard with 'client-ops &&'...

PT-2026-121852

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for dec output info If the driver's dec output info contains invalid data the driver can write in invalid memory. Add a range check for that. This fixes this smatch error:...

PT-2026-121867

In the Linux kernel, the following vulnerability has been resolved: ksmbd: don't hold ci-m lock while waiting for a lease break ack When a cifs.ko client caches a read-handle RH lease via deferred close and a conflicting open arrives, ksmbd breaks the lease and waits for the acknowledgment in wai...

PT-2026-121875

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfd queue acquire buffers was split off from set queue properties from user, set queue properties from criu was missed. Thus, set queue properties from criu is not...

PT-2026-121915

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Clean up locking This cleans up several issues with locking behavior, including RCU accesses not being guarded behind a lock...

PT-2026-121842

In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG on unknown typed-extent type vxfs bmap typed handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from...

PT-2026-121844

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect Clearly, from a user perspective, it must be valid to configure WoWLAN and then suspend while not connected to a network. Since mac80211 doesn't distinguish these cas...

PT-2026-121864

In the Linux kernel, the following vulnerability has been resolved: drm/amd/ras: reset CPER ring on corrupt entry size When CPER ring overflow handling advances the read pointer, it trusts the parsed entry size from the current ring contents. Corrupt CPER data can produce an entry size that does...