PT-2026-121948

In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devm add action or reset invokes the cleanup action immediately when registering the action fails. gpio exar probe currently stores the allocated ID in exar gpio only...

PT-2026-121986

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcomm mutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

PT-2026-122015

In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx usb ms: complete requests after eject instead of dropping them memstick check can pass its host-removing check just before rtsx usb ms drv remove sets eject/removing. Its next request is then silently dropped: rtsx...

PT-2026-121951

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch containing an incomplete description of a bug in XFS IOC EXCHANGE RANGE's TO EOF flag. The bug tricks exchange-range into modifying a file so that it...

PT-2026-121984

In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: defer setup when fbdev probe fails, not just on -EAGAIN drm fb helper initial config and unlock calls drm client modeset probe first, which already fills in each mode set-mode/num connectors for every connected...

PT-2026-122035

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current pwq deref in chained work check current wq worker only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker-current pwq is populated...

PT-2026-122011

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhci sprd probe enables runtime PM, while sdhci sprd remove does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM before disabling the...

PT-2026-121854

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided max segs The max segs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmc alloc sg to call kmalloc obj...

PT-2026-121957

In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. step into step into rechecks d seq and follow mount rcu rechecks mount lock. An entry that gets unlinked in between caus...

PT-2026-122052

In the Linux kernel, the following vulnerability has been resolved: rust binder: reschedule node refcount update on thread exit When a thread exits via BINDER THREAD EXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferr...

PT-2026-121850

In the Linux kernel, the following vulnerability has been resolved: ntfs3: handle set blocksize failures ntfs3 uses buffer heads, which don't handle block size PAGE SIZE well. Without this, mounting we will hit the BUG ONoffset = folio sizefolio; in folio set bh on the first bread gfp call...

Microsoft Windows 11 23H2 Kernel Streaming Privilege Escalation

Microsoft Windows 11 version 23H2 build 22631 contains a Kernel Streaming race condition that can allow a local attacker to enable SeDebugPrivilege and start a SYSTEM command shell. This proof of concept demonstrates exploitation. https://packetstorm.news/download/237294...

PT-2026-121927

In the Linux kernel, the following vulnerability has been resolved: flow dissector: avoid u16 truncation of skb-len when computing thoff skb flow dissect computes key control-thoff using: key control-thoff = min tu16, nhoff, skb ? skb-len : hlen; min tu16, ... casts both arguments to u16 before...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.6.158, 6.12.111, and 6.18.53. This vulnerability arises because kfddbgtrapenable fails to revert enabled debug traps and related states when copying runtimeinfo into user space; as a result, trap states become inconsistent and...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.2. It arises because ioconnectbpfpopulate fills the CONNECT filter field only when addrlen is at least 28 bytes; however, IPv6 connection paths accept addresses with a SIN6LENRFC2133 value of 24 bytes. When addrlen is 24, the filter sees n...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.16. It arises because memstickcheck checks before setting eject/removing; subsequent requests are silently discarded without any action being taken, causing the removal process to hang and blocking the work queue...

Linux kernel security vulnerabilities

A security vulnerability exists in the Linux kernel; it arises when reading the write-only HRST and CLIRQ registers triggers a command, causing a dump of regular registers to result in a reset of the development board...

PT-2026-121935

In the Linux kernel, the following vulnerability has been resolved: btrfs: always return -EIOCBQUEUED after btrfs uring read extent endio If all bios finish before btrfs encoded read regular fill pages returns, it calls btrfs uring read extent endio and previously returned the I/O status. A...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.6. It stems from ath11k failing to reset numstations during hardware startup; multiple hardware reboots subsequently result in the inability to add new stations or mesh peers...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.13. It stems from a failure to call hfreelogicallan when the RX buffer pool allocation fails after ibmvethopen registers a logical LAN; as a result, PHYP retains ownership of the page during the unmapping of the buffer list page...