PT-2026-121922

In the Linux kernel, the following vulnerability has been resolved: flow dissector: avoid u16 truncation of hlen in bpf flow dissect bpf flow dissect sanitizes the offsets returned by the BPF program with clamp tu16, ..., hlen. If hlen is bigger than 65535, the upper bound is truncated before the...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.18.55 and 7.2.9. This vulnerability stems from a default insufficient size of the kernel stack in 64-bit kernels, which may lead to a kernel stack overflow and trigger a kernel crash...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.13. It stems from the fact that btrfs fails to always return -EIOCBQUEUED after btrfsuringreadextentendio. When all bio operations are completed prior to btrfsencodedreadregularfillpages returning, a negative errno is returned. This result...

PT-2026-121934

In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfs uring read extent fails After btrfs uring read extent, the caller always jumped to out acct. That skips kfreedata-iov, which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 7.2.10. It arises because the cid table of schedext becomes visible to cid kfuncs during modification. Under race conditions, TRACING or SYSCALL programs may read uninitialized entries, potentially leading to memory leaks or...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.6.143, from 6.12.93 up to 6.12.112, from 6.18.17 up to 6.18.55, from 6.19.7 up to 6.20, and version 7.0. This vulnerability arises because ioremapprot on ARM64 architecture fails to reject protection values lacking PTEUSER; as a...

Red Hat: CVE-2026-98873: kernel: netfilter: nf_conntrack_expect: zero at allocation time

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackexpect: zero at allocation time There are occasional LLM hints wrt. leaking uninitialized data to userspace via ctnetlink. Just zero at allocation time, expectations are not frequently used these days...

Linux kernel security vulnerabilities

Security vulnerabilities exist in Linux kernel versions from 4.4.281 up to 4.5, from 4.9.280 up to 4.10, from 4.14.244 up to 4.15, from 4.19.203 up to 4.20, from 5.4.140 up to 5.5, from 5.10.58 up to 5.11, from 5.13.10 up to 5.14, and specifically in version 5.14. The vulnerability arises because...

PT-2026-121912

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID is a hardware port ID and is not necessarily the index of the corresponding entry in variant-dai driver. When configuring a DAI with LPAIF I2SCTL MODE...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.0. It stems from the fact that the isosockconnect function in Bluetooth ISO fails to serialize concurrent connect calls. As a result, multiple callers can pass through admission checks and replace socket connections simultaneously, leading...

PT-2026-121994

In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCV ALTERNATIVE EARLY for THEAD GHOSTWRITE errata probe ghostwrite only marks the CPU as vulnerable when it is called at the RISCV ALTERNATIVES EARLY BOOT stage, and the mitigation in ghostwrite enable...

PT-2026-121944

In the Linux kernel, the following vulnerability has been resolved: cxgb4/ch ktls: disable softirqs around tid list erases chcr ktls cpl act open rpl inserts into tid list from the receive path using xa insert bh. The array is shared by the adapter's connections and initialized with XA FLAGS LOCK...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.8. It stems from the axienet driver failing to release unfinished DMA buffers when dmaengine is disabled, resulting in a leak of SKB and its DMA mappings. This may exhaust the limited IOMMU address space, and there is also a race condition...

PT-2026-121847

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed When accidentally setting “kvm-arm.vgic v4 enable=1” on a system that has no MSI controller device tree node and GICv4, it results a panic as “gic domain” is NULL and the...

Red Hat: CVE-2026-98872: kernel: freevxfs: don't BUG() on unknown typed-extent type

In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG on unknown typed-extent type vxfsbmaptyped handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from...

PT-2026-121879

In the Linux kernel, the following vulnerability has been resolved: net: cpsw new: unregister devlink on port registration failure cpsw probe registers devlink before registering the CPSW ports. If cpsw register ports fails, the error path only unregisters the notifiers and then releases the lowe...

PT-2026-122055

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AF XDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actual wq head is not advanced...

PT-2026-121989

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Serialize concurrent connect calls iso sock connect checks the socket state before taking the socket lock and drops the lock again before setting up a connection. Two callers can both pass the admission check whil...

PT-2026-122018

In the Linux kernel, the following vulnerability has been resolved: ip6 gre: remove obsolete ERSPAN PMTU update A tc tunnel key action can attach a METADATA IP TUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspan tunnel xmit treats tha...

PT-2026-122063

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dm integrity resume re-reads the superblock from the device so that it picks up the flags and the recalculate position. It performs no validation on the result, while the constructo...