PT-2026-122059

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached MMIO information. Both the fill and validation paths use kvm memslot...

PT-2026-121842

In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG on unknown typed-extent type vxfs bmap typed handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from...

PT-2026-121855

In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which...

PT-2026-121993

In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access access ok checks untagged addruaddr, but arch futex atomic op inuser and futex atomic cmpxchg inatomic hand the raw uaddr to the inline asm amoswap/amoadd/.../lr.w+sc....

PT-2026-122032

In the Linux kernel, the following vulnerability has been resolved: tcp: reject net iov in zerocopy receive mapping hints After copying a readable prefix, receive fallback to copy asks tcp zerocopy set hint for skb where page mapping can resume. If the next skb is unreadable, find next mappable...

PT-2026-122041

In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipso v4 skbuff delattr removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a...

PT-2026-122055

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AF XDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actual wq head is not advanced...

PT-2026-121914

In the Linux kernel, the following vulnerability has been resolved: sched ext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes the global pointers before filling them, ops.init cids overrides...

PT-2026-121908

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar-num stations on hardware start When multiple hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'num stations' in 'struct ath11k' that did not...

PT-2026-121963

In the Linux kernel, the following vulnerability has been resolved: namespace: remove the fsnotify marks of a mount namespace in process context mnt ns release drops the last passive reference of a mount namespace and removes its fanotify marks via fsnotify mntns delete. That takes the mutex of...

PT-2026-121965

In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPEN TREE NAMESPACE open treeOPEN TREE NAMESPACE creates a new mount namespace from a copy of the tree at the given path. The caller needs to be privileged over its current user namespace...

PT-2026-122028

In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverity info fsverity get info calls rhashtable lookup fast, which just uses rcu read lock and doesn't directly synchronize with fsverity remove info. For the same inode this isn't a...

PT-2026-122047

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6 info hw flags set sizes the skb with rt6 nlmsg size and later fills it with rt6 fill node. With nexthop compatibility mode enabled, a concurrent replacement can grow the grou...

PT-2026-122046

In the Linux kernel, the following vulnerability has been resolved: Input: ati remote2 - fix type confusion in device attribute handlers Previously, the channel mask and mode mask attributes were registered on the parent usb device via sysfs create group. When commit b20d6bf8014b "Input:...

PT-2026-122029

In the Linux kernel, the following vulnerability has been resolved: selinux: preserve NATIVE LABELS on already-initialized sb in set mnt opts When an NFSv4 filesystem exported with security label is mounted a second time, sget fc returns the existing superblock and nfs get root calls security sb...

PT-2026-122058

In the Linux kernel, the following vulnerability has been resolved: bnxt en: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces: DMAR: DMA Read NO PASID Request...

PT-2026-122056

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect to an AF XDP socket fails because its RX ring is full, the XSK core frees the buffer. During the subsequent batched refill of a legacy cyclic RQ,...

PT-2026-121894

In the Linux kernel, the following vulnerability has been resolved: net: emac: move setting of netops to fix crash fixes the following crash on driver initialization: |BUG: Kernel NULL pointer dereference on read at 0x00000158 |Faulting instruction address: 0xc0566b40 |Oops: Kernel access of bad...

PT-2026-121903

In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT, nanddev get ecc engine takes the NAND ECC ENGINE TYPE NONE path and returns success while leaving nand-ecc.engine NULL. The...

PT-2026-121840

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free write occurs in the ksmbd module during connection teardown. The ksmbd sessions deregister function only removes channels from other sessions if the conn-binding flag is...