PT-2026-121901

In the Linux kernel, the following vulnerability has been resolved: macsec: initialize SecY before registering the netdevice Creating a MACsec device with MAC offload over an LRO-capable lower device triggers a warning in rtmsg ifinfo build skb when IPv4 forwarding is enabled by default. register...

PT-2026-121898

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS Why stream-sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences is for stream-sink-link, which can be...

PT-2026-121881

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dpaa2-switch component where the dpaa2 switch rx function incorrectly calls dpaa2 switch free fd during an error path to free a frame descriptor FD. The dpaa2 swit...

PT-2026-121878

In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5 tc flower psfp setup allocates PSFP stream gate, flow meter and stream filter resources before adding VCAP actions. If a later step fails, the resourc...

PT-2026-121883

In the Linux kernel, the following vulnerability has been resolved: net: thunderx: fix PTP device ref leak in nicvf probe cavium ptp get acquires a reference to the PTP PCI device through pci get device. If any initialization step fails after cavium ptp get, the PTP PCI device reference is leaked...

PT-2026-121893

In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl do mkdir debug print ovl do mkdir prints the input dentry with %pd after vfs mkdir. Since commit fe497f0759e0 "VFS: change vfs mkdir to unlock on failure.", vfs mkdir calls end creating on the input dentry on...

PT-2026-121886

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change When trying to do a color change, validate that the link is beaconing first, to avoid calling the driver with an invalid link...

PT-2026-121856

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xfer read waits for the HDMI I2C transaction to reach I2C TRANSACTION DONE, but it ignores both timeout and signal returns from wait for completion interruptible timeout. If...

PT-2026-121860

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: reject short monitor TX frames In monitor mode, lbs hard start xmit casts skb-data to a radiotap TX header, skips that header, and then copies the 802.11 destination address from offset 4 in the remaining frame. T...

PT-2026-121873

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imx mu isr imx mu shutdown imx mu xcr rmwpriv, IMX MU RCR, 0, IMX MU xCR RIEnpriv-dcfg-type, cp-idx; imx mu...

PT-2026-121857

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211 hwsim: reject undersized HWSIM ATTR TX INFO hwsim tx info frame received nl casts the HWSIM ATTR TX INFO payload to a struct hwsim tx rate and unconditionally reads IEEE80211 TX MAX RATES entries 8 bytes from it. T...

PT-2026-121871

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix lease break and ack state handling Do not skip valid lease states containing WRITE CACHING when breaking level-II/read leases for writes and truncates. Handle lease break acknowledgments according to the SMB2 rule that...

PT-2026-121892

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef "netfs: Fix folio queue ENOMEM in writeback by adding a mempool" added a mempool for the folio queues and made the request, subrequest and folio...

PT-2026-121861

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211 rx mgmt deauth reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame...

PT-2026-121874

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devm pm runtime enable sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pm runtime enable into the removal path instead doing it early. This...

PT-2026-122430

Summary Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's url.Values.Get returns only the first value...

ROS-20261023-73-0211

The vulnerability in the kernel-lt is related to insufficient control of resources with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-122042

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guarantee active cpus With commit 2125c0034c5d "cgroup/cpuset: Make cpuset hotplug processing synchronous", the cpuset hotplug operation becomes synchronous. That commit also removes the...

PT-2026-121969

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree may copy tree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no...

PT-2026-121869

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter ipset component regarding the improper marking of RCU Read-Copy-Update locked areas. Specifically, the RCU lock is unnecessarily held when incrementing t...