PT-2026-122430

Summary Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's url.Values.Get returns only the first value...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.6.158, 6.12.111, and 6.18.53. This vulnerability arises because kfddbgtrapenable fails to revert enabled debug traps and related states when copying runtimeinfo into user space; as a result, trap states become inconsistent and...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.2. It arises because ioconnectbpfpopulate fills the CONNECT filter field only when addrlen is at least 28 bytes; however, IPv6 connection paths accept addresses with a SIN6LENRFC2133 value of 24 bytes. When addrlen is 24, the filter sees n...

PT-2026-121969

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree may copy tree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no...

PT-2026-121962

In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivot root path pivot root reads the parents of new root and of the caller's root and checks whether they are shared before it checks that either mount is in the caller'...

PT-2026-121954

In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attach recursive mnt locks every copy of the source mount to protect overmounts from vanishing and revealing the underlying...

PT-2026-121936

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvmet req alloc p2pmem sgls function where req-p2p dev is assigned only after both data and metadata SGL Scatter Gather List allocations succeed. If data allocatio...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.14. It stems from the failure of the drm/fb-helper to delay initialization when fbdevprobe fails, resulting in an old modeset being submitted even when modeset-fb is empty, thereby triggering a WARNON!set-fb...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.6.160, 6.12.113, 6.18.57, and 7.2.11. This vulnerability arises because a lock is not held when calling dmtablegetmodenewmap via doresume; concurrent ioctl operations on the same device may swap tables after dmswaptable but befor...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.16. It arises because memstickcheck checks before setting eject/removing; subsequent requests are silently discarded without any action being taken, causing the removal process to hang and blocking the work queue...

Linux kernel security vulnerabilities

A security vulnerability exists in the Linux kernel; it arises when reading the write-only HRST and CLIRQ registers triggers a command, causing a dump of regular registers to result in a reset of the development board...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions from 5.10.270 up to and including 5.11, from 5.15.221 up to and including 5.16, from 6.1.188 up to and including 6.2, from 6.6.157 up to and including 6.6.160, from 6.12.109 up to and including 6.12.114, from 6.18.50 up to and including...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.16. It arises because amt devices’ buffers of skb objects reference the original pointers within their skb-cb fields. When these buffers are released due to a tunnel expiration, subsequent enqueuing operations trigger reuse after release i...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.20. It arises because bpfflowdissect fails to enforce hlen to U16MAX prior to clamping it when processing offsets returned by BPF programs. If hlen exceeds 65535, it is truncated to U16MAX, causing nhoff and thoff to be forced to zero. Thi...

PT-2026-121935

In the Linux kernel, the following vulnerability has been resolved: btrfs: always return -EIOCBQUEUED after btrfs uring read extent endio If all bios finish before btrfs encoded read regular fill pages returns, it calls btrfs uring read extent endio and previously returned the I/O status. A...

PT-2026-121893

In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl do mkdir debug print ovl do mkdir prints the input dentry with %pd after vfs mkdir. Since commit fe497f0759e0 "VFS: change vfs mkdir to unlock on failure.", vfs mkdir calls end creating on the input dentry on...

PT-2026-122054

In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception FNHE is only created if the kernel c...

PT-2026-121987

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcomm recv data hands the skb to d-data ready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the...

Linux kernel security vulnerabilities

A security vulnerability exists in the Linux kernel. It stems from the fact that seg6makeflowlabel fails to use skbgethashnet to obtain a network pointer. When an skb lacks both skb-dev and skb-sk, skbflowdissect triggers a warning due to the absence of a network pointer; this may result in null...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.6. It stems from ath11k failing to reset numstations during hardware startup; multiple hardware reboots subsequently result in the inability to add new stations or mesh peers...