PT-2026-122057

In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clear inode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with...

PT-2026-121931

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfs dir item item that packs multiple xattrs and then we replace the value of one of them with the setxattr2 family of syscalls with another...

PT-2026-122017

In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix add key race with keyring restriction key create or update snapshots keyring-restrict link before taking the destination keyring's semaphore. keyring restrict installs a restriction while holding that semaphore. This...

PT-2026-122020

In the Linux kernel, the following vulnerability has been resolved: ice: fix metadata dst refcount handling on representor teardown ice eswitch release repr uses metadata dst free to release the representor's metadata dst. metadata dst free directly frees the underlying memory without checking th...

PT-2026-121850

In the Linux kernel, the following vulnerability has been resolved: ntfs3: handle set blocksize failures ntfs3 uses buffer heads, which don't handle block size PAGE SIZE well. Without this, mounting we will hit the BUG ONoffset = folio sizefolio; in folio set bh on the first bread gfp call...

PT-2026-121906

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skb get hash net in seg6 make flowlabel Since commit d58e468b1112 "flow dissector: implements flow dissector BPF hook" skb flow dissect needs a net pointer, either from skb-dev, skb-sk, or since commit 3cbf4ffba5ee...

PT-2026-121991

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: Fix command skb lifetime during scan setup During PA sync scan setup, hci le set ext scan param sync gets the address used for the PA LINK lookup from hci sent cmd data. The returned pointer borrows storage...

PT-2026-121880

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copy to user failure If kfd dbg trap enable fails while copying runtime info to userspace, it had already activated the trap, set debug trap enabled, taken an extra process reference, and...

PT-2026-122022

In the Linux kernel, the following vulnerability has been resolved: ibmveth: h free logical LAN on open-fail after register ibmveth open registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out free buffer pools without h free logical lan, so PHYP still owns the...

PT-2026-122027

In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio mpsse irq enable arms the poll worker before publishing it: schedule work runs before the worker is added to priv-workers. If gpio mpsse disconnect walks the list in that...

PT-2026-122061

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iterate dir takes the directory's i rwsem shared and holds it across -iterate shared. For a directory that never has an entry and is never removed the lock keeps nothing still...

PT-2026-122024

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak when rings are stopped GVE does not free XSK buffers when resetting ring state as a part of stopping queues. This causes all XSK buffers which are posted to the NIC to be leaked. Free XSK buffers attached...

PT-2026-121915

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Clean up locking This cleans up several issues with locking behavior, including RCU accesses not being guarded behind a lock...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.6.160, 6.12.113, 6.18.57, and 7.2.11. This vulnerability arises because a lock is not held when calling dmtablegetmodenewmap via doresume; concurrent ioctl operations on the same device may swap tables after dmswaptable but befor...

Red Hat: CVE-2026-98871: kernel: crypto: ccp - Fix possible deadlock in SEV init failure path

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix possible deadlock in SEV init failure path sevplatforminithandleinitexpath calls rmpmarkpagesfirmware with locked=false while the parent function of initexpath already acquired the sevcmdmutex. In the case of an...

Red Hat: CVE-2026-98872: kernel: freevxfs: don't BUG() on unknown typed-extent type

In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG on unknown typed-extent type vxfsbmaptyped handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from...

Red Hat: CVE-2026-98876: kernel: host1x: bus: Fix missing ops null check in error teardown

In the Linux kernel, the following vulnerability has been resolved: host1x: bus: Fix missing ops null check in error teardown In host1xdeviceinit, the error teardown paths do not check client-ops before dereferencing it, unlike the forward init paths which correctly guard with 'client-ops &&'. Th...

kernel security, bug fix, and enhancement update

5.14.0-687.60.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

PT-2026-121841

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix possible deadlock in SEV init failure path sev platform init handle init ex path calls rmp mark pages firmware with locked=false while the parent function of init ex path already acquired the sev cmd mutex. In t...

PT-2026-121846

In the Linux kernel, the following vulnerability has been resolved: host1x: bus: Fix missing ops null check in error teardown In host1x device init, the error teardown paths do not check client-ops before dereferencing it, unlike the forward init paths which correctly guard with 'client-ops &&'...