PT-2026-121879

In the Linux kernel, the following vulnerability has been resolved: net: cpsw new: unregister devlink on port registration failure cpsw probe registers devlink before registering the CPSW ports. If cpsw register ports fails, the error path only unregisters the notifiers and then releases the lowe...

PT-2026-122059

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached MMIO information. Both the fill and validation paths use kvm memslot...

PT-2026-121924

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the PFCP Packet Forwarding Control Protocol implementation where pfcp encap recv fails to ensure that the 8-byte Session Endpoint Identifier SEID is in the linear area...

PT-2026-121953

In the Linux kernel, the following vulnerability has been resolved: namespace: keep the lock on a mount that a propagated copy is moved beneath attach recursive mnt transfers MNT LOCKED from the top mount to the mount that is moved beneath it with MOVE MOUNT BENEATH. This allows the owner of a us...

PT-2026-121876

In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966x fdma reload backs up rx-page pool and rx-fdma before reallocating the RX resources for the new MTU. If the allocation fails, the restore path puts these fields back before...

PT-2026-121944

In the Linux kernel, the following vulnerability has been resolved: cxgb4/ch ktls: disable softirqs around tid list erases chcr ktls cpl act open rpl inserts into tid list from the receive path using xa insert bh. The array is shared by the adapter's connections and initialized with XA FLAGS LOCK...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.6.160, 6.12.113, 6.18.57, and 7.2.11. This vulnerability arises because a lock is not held when calling dmtablegetmodenewmap via doresume; concurrent ioctl operations on the same device may swap tables after dmswaptable but befor...

PT-2026-122037

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global...

PT-2026-121951

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch containing an incomplete description of a bug in XFS IOC EXCHANGE RANGE's TO EOF flag. The bug tricks exchange-range into modifying a file so that it...

PT-2026-121917

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the HID steam component during the teardown sequence. A narrow timing window allows callbacks to be scheduled during cleanup, resulting in a dangling pointer to the free...

PT-2026-121920

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum flower: Fix port range register leak in tmplt create mlxsw sp flower tmplt create parses a flow cls offload template into a stack-local struct mlxsw sp acl rule info purely to compute rulei.values.elusage. Parsing...

PT-2026-121912

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID is a hardware port ID and is not necessarily the index of the corresponding entry in variant-dai driver. When configuring a DAI with LPAIF I2SCTL MODE...

PT-2026-121931

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfs dir item item that packs multiple xattrs and then we replace the value of one of them with the setxattr2 family of syscalls with another...

PT-2026-121914

In the Linux kernel, the following vulnerability has been resolved: sched ext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes the global pointers before filling them, ops.init cids overrides...

PT-2026-121919

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmci transport recv dgram cb During the closure of a datagram socket, the vmci transport recv dgram cb function may be called, which will add the packets to the socket's backlog; then, after the receive...

PT-2026-121911

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Drop unnecessary PMD page copy when freeing On a box with a discrete GPU, lockdep reports a possible deadlock as soon as kswapd shrinks the TTM page pool. The immediate cause is an x86 commit that added an mmap read lock ...

PT-2026-121932

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash io uring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfs uring encoded data in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. io uring does not free driver PDU...

PT-2026-121908

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar-num stations on hardware start When multiple hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'num stations' in 'struct ath11k' that did not...

PT-2026-121934

In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfs uring read extent fails After btrfs uring read extent, the caller always jumped to out acct. That skips kfreedata-iov, which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On...

PT-2026-121966

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops do loopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own fil...