PT-2026-121855

In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which...

Linux kernel security vulnerabilities

Security vulnerabilities exist in Linux kernel versions prior to 6.18.53 and 7.2.7 for versions 6.18.53 through 6.18.56, as well as in versions prior to 7.2.7 for versions 7.2.7 through 7.2.10. These vulnerabilities arise from unnecessary copying of PMD pages during page table release; holding...

PT-2026-121970

In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNT UMOUNT in clone mnt MNT UMOUNT gets raised on a mount that umount tree or umount one has taken out of its namespace. It's never cleared. detach mounts unhooks a mount that carries it instead of...

PT-2026-121937

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ICE driver on arm64 architectures due to improper ordering of Memory-Mapped I/O MMIO writes for transmit doorbells. The driver uses the writel relaxed...

PT-2026-121947

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4 bo cache destroy purges the cached BOs but never frees the size list, leaking it on every unbind...

PT-2026-122041

In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipso v4 skbuff delattr removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a...

PT-2026-122007

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb copy and csum bits When skb copy and csum bits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The calle...

PT-2026-121869

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter ipset component regarding the improper marking of RCU Read-Copy-Update locked areas. Specifically, the RCU lock is unnecessarily held when incrementing t...

PT-2026-121877

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb write pointer with invalidate lock sb write pointer reads the super block from the block device page cache using read cache page gfp. This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568...

PT-2026-121918

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4 irq disable masks the V3D interrupt sources and then calls synchronize irq before the V3D is powered down. However, by itself, this is not enough to quiesce the...

PT-2026-121921

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vm bo handling in remap When a map overlaps part of an existing mapping, pvr vm gpuva remap splits the mapping into prev/next parts covering what the request did not take, instead of creating...

PT-2026-121976

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinned link entry when fb-pin performs the final unpin xe bo pin external and xe bo unpin external maintain the bo's pinned link list membership in xe-pinned.late.external, based on whether the current call is t...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.1. It stems from holding an inode lock for too long when reading from an immutable directory. Attackers can delay the getdents response via FUSE mounting, thereby blocking directory lookup, creation, and mounting operations, leading to a...

PT-2026-122012

In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req timeout while a request is active. msdc request done uses cancel delayed work, which does not wait for a timeout callback that has already started. The...

CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1792750763)

"The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1792750763 advisory. - In the Linux kernel, the following vulnerability has been resolved: RDMA: Fix use-after-free in rxequeuecleanup On error handling...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.18. It arises from the failure to hash dentrys prior to their detachment, resulting in a race condition between detachmounts and ddelete. This may expose the contents of hidden files mounted on the system...

PT-2026-121873

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imx mu isr imx mu shutdown imx mu xcr rmwpriv, IMX MU RCR, 0, IMX MU xCR RIEnpriv-dcfg-type, cp-idx; imx mu...

Rocky Linux 8.10 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ciqsa-2026_1683)

The Rocky Linux 8.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261683 advisory. This advisory aggregates security fixes for the kernel SRPM in CIQ Core 8.10. It addresses 10 CVEs: CVE-2024-49978, CVE-2025-21927, CVE-2026-31677,...

PT-2026-121927

In the Linux kernel, the following vulnerability has been resolved: flow dissector: avoid u16 truncation of skb-len when computing thoff skb flow dissect computes key control-thoff using: key control-thoff = min tu16, nhoff, skb ? skb-len : hlen; min tu16, ... casts both arguments to u16 before...

PT-2026-121998

In the Linux kernel, the following vulnerability has been resolved: regulator: of: fill in supply names in of regulator bulk get all of regulator bulk get all returns an array it allocated itself, and fills in only the consumer of each entry. Every other way of getting a bulk array has the supply...