CVE-2026-98726

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express multipath subsystem. A malicious NVMe device can provide crafted Asymmetric Namespace Access ANA log data that triggers an integer underflow during buffer bounds validation. This failure leads to an out-of-bounds memory read,...

CVE-2026-98730

A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. A local user with access to the Bluetooth Host Controller Interface HCI user channel can inject an oversized transmission packet. Because the driver fails to validate packet length before copying data into a fixed-size memory...

CVE-2026-98727

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express multipath subsystem. The multipath driver inappropriately marks a storage device as supporting zoned storage before confirming its zone configuration. When a device reports a zone size of zero, subsequent read or write...

CVE-2026-98729

A flaw was found in the Linux kernel. On systems utilizing specific AMD processors, improper virtual address alignment for huge page memory mappings can allow a local user to cause a Denial of Service DoS. When unmapping these misaligned memory ranges during teardown, the kernel encounters an...

PT-2026-121879

In the Linux kernel, the following vulnerability has been resolved: net: cpsw new: unregister devlink on port registration failure cpsw probe registers devlink before registering the CPSW ports. If cpsw register ports fails, the error path only unregisters the notifiers and then releases the lowe...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.1.189, 6.6.158, 6.12.111, and 6.18.53. This vulnerability arises because the vb2videounregisterdevice function is not utilized when removing the video-i2c driver; as a result, the vb2 queue may fail to disconnect properly before...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.0. It stems from the fact that the isosockconnect function in Bluetooth ISO fails to serialize concurrent connect calls. As a result, multiple callers can pass through admission checks and replace socket connections simultaneously, leading...

PT-2026-122051

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 "net: ipv4: Cache pmtu for all packet paths if multipath enabled" made ip rt update pmtu update every path. For nexthop objects, fib info num path and fib info n...

Linux kernel security vulnerabilities

Security vulnerabilities exist in Linux kernel versions prior to 6.18.53 and 7.2.7 for versions 6.18.53 through 6.18.56, as well as in versions prior to 7.2.7 for versions 7.2.7 through 7.2.10. These vulnerabilities arise from unnecessary copying of PMD pages during page table release; holding...

Linux kernel security vulnerabilities

A security vulnerability exists in the Linux kernel. It stems from the fact that seg6makeflowlabel fails to use skbgethashnet to obtain a network pointer. When an skb lacks both skb-dev and skb-sk, skbflowdissect triggers a warning due to the absence of a network pointer; this may result in null...

PT-2026-121911

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Drop unnecessary PMD page copy when freeing On a box with a discrete GPU, lockdep reports a possible deadlock as soon as kswapd shrinks the TTM page pool. The immediate cause is an x86 commit that added an mmap read lock ...

PT-2026-121859

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwl mvm scan fits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwl mvm build scan probe aft...

PT-2026-121863

In the Linux kernel, the following vulnerability has been resolved: firmware: arm scmi: Validate SENSOR UPDATE payload size SENSOR UPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did...

PT-2026-121950

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: Fix unlocked list del in drm bridge add When re-adding a bridge that was previously removed, drm bridge add drops it from bridge lingering list without holding bridge lock. Both bridge list and bridge lingering list a...

PT-2026-121954

In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attach recursive mnt locks every copy of the source mount to protect overmounts from vanishing and revealing the underlying...

PT-2026-121969

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree may copy tree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no...

PT-2026-121975

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove callback This driver stores struct th1520 hdmi in platform drvdata, but th1520 dw hdmi remove was reading it back as struct dw hdmi and passing it to dw hdmi remove, so teardown runs on the...

PT-2026-121979

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.8. It stems from pvrvmgpuvaremap within drm/imagination failing to release GEM references obtained from split parts when remapping occurs. These split parts are then incorrectly linked to vmbo of a new object, resulting in reference leaks...

PT-2026-122016

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstick alloc card and memstick set rw addr, wait for completion timeout is used to wait for device identification and address configuration requests to complete...