PT-2026-121987

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcomm recv data hands the skb to d-data ready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the...

Linux kernel security vulnerabilities

A security vulnerability exists in the Linux kernel. It stems from the fact that seg6makeflowlabel fails to use skbgethashnet to obtain a network pointer. When an skb lacks both skb-dev and skb-sk, skbflowdissect triggers a warning due to the absence of a network pointer; this may result in null...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.6.160, 6.12.113, 6.18.57, and 7.2.11. This vulnerability arises from a missing code block that deactivates the battery upon subsequent registration failures during the refactoring of the HID Steam driver registration process; as ...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.18. It arises from the failure to hash dentrys prior to their detachment, resulting in a race condition between detachmounts and ddelete. This may expose the contents of hidden files mounted on the system...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.6. It stems from ath11k failing to reset numstations during hardware startup; multiple hardware reboots subsequently result in the inability to add new stations or mesh peers...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.14. It stems from the ASoC qcom lpass-cpu driver’s use of DAI IDs as indices for the variant-daidriver array when configuring DAI, rather than using cyclic indices. This results in out-of-bounds writes or improper access to the DAI table...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.13. It stems from a failure to call hfreelogicallan when the RX buffer pool allocation fails after ibmvethopen registers a logical LAN; as a result, PHYP retains ownership of the page during the unmapping of the buffer list page...

PT-2026-121999

In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST 0x1e and CLIRQ 0x1f are write-only command strobes. Writing HRST triggers a hard reset of the chip and writing CLIRQ clears the interrupt; reading them...

PT-2026-122001

In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized optee probe called tee device register on both the client and the supplicant device before the rest of struct optee had been initialized. tee device register calls cdev devi...

PT-2026-121992

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hci sock bind clears hci pisk-hdev and drops the device...

PT-2026-121996

In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices ch readconfig looks up the scsi device of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in ch-dt. scsi device...

PT-2026-122008

In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup br multicast sg del exclude ports removes automatically added STAR EXCL port groups by calling br multicast del pg. For S,G entries, that deletion calls back into br multicast s...

PT-2026-121927

In the Linux kernel, the following vulnerability has been resolved: flow dissector: avoid u16 truncation of skb-len when computing thoff skb flow dissect computes key control-thoff using: key control-thoff = min tu16, nhoff, skb ? skb-len : hlen; min tu16, ... casts both arguments to u16 before...

PT-2026-121922

In the Linux kernel, the following vulnerability has been resolved: flow dissector: avoid u16 truncation of hlen in bpf flow dissect bpf flow dissect sanitizes the offsets returned by the BPF program with clamp tu16, ..., hlen. If hlen is bigger than 65535, the upper bound is truncated before the...

PT-2026-121903

In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT, nanddev get ecc engine takes the NAND ECC ENGINE TYPE NONE path and returns success while leaving nand-ecc.engine NULL. The...

PT-2026-121945

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the AMT Automatic Multicast Tunneling module. An socket buffer skb queued in a queuing discipline qdisc can outlive the tunnel it references via a raw...

PT-2026-121946

In the Linux kernel, the following vulnerability has been resolved: net/sched: em text: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a "net/sched: fix potential stack infoleak in em text dump", which zero-initialised the dump-side struct. Sashiko pointed at a...

PT-2026-121947

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4 bo cache destroy purges the cached BOs but never frees the size list, leaking it on every unbind...

PT-2026-122038

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmf detach When the driver is removed while the user space process that created the P2P device e.g. wpa supplicant is still exiting, the P2P device interface is removed twice and t...

PT-2026-122060

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5 authenticate In krb5 authenticate, out len is calculated to determine available headroom in response buf for the incoming Kerberos AP-REP token. However, when SMB2 SESSION SETUP is...