PT-2026-79689

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tap get user xdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in dev parse header protocol when skb-dev is null" fixed a crash in tap get user by assigning...

PT-2026-79698

In the Linux kernel, the following vulnerability has been resolved: net: prestera: validate firmware header length prestera fw hdr parse reads the firmware header before checking that the firmware image contains that header. Reject images shorter than struct prestera fw header before decoding the...

PT-2026-79704

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix memory leak in exec queue set hang replay state The q-replay state is blindly overwritten, which can potentially leak memory that was previously allocated by vmemdup user. Return an error if q-replay state is not empt...

PT-2026-79616

In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msg iter before TLS 1.3 optimistic retry tls decrypt sg advances msg-msg iter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application...

PT-2026-79620

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlan changelink arms vxlan-age timer whenever the requested ageing interval differs from the configured one: if conf.age interval != vxlan-cfg.age interval mod...

PT-2026-79636

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smc rx splice smc rx splice passes pages to splice to pipe before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splice to pipe may...

PT-2026-79590

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound the DROM dual link port number before indexing sw-ports tb drom parse entry port validates the device-supplied header-index against sw-config.max port number before indexing sw-ports, but the sibling field...

PT-2026-79596

In the Linux kernel, the following vulnerability has been resolved: mm/filemap: filemap add folio restore index before retrying In filemap add folio's split-a-conflict loop, xas set order is applied repeatedly: each application modifies xas.xa index, rounding it down according to the split order...

PT-2026-79661

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fib nhc update mtu fib nhc update mtu walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcu dereference protected with a...

PT-2026-79617

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the veth driver where non-linear skb fragments are exposed through an xdp buff. When an XDP program adjusts the fragment area, the veth xdp rcv skb function fails to...

PT-2026-79629

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct-lock is still held. When invalid logging is routed to nfnetlink log and conntrack export is enabled,...

PT-2026-79601

In the Linux kernel, the following vulnerability has been resolved: fs,fsverity: remove check for fsverity being enabled in setattr prepare The check that fs-verity is available in the kernel is not necessary here. Filesystems could have fsverity files even without fs-verity enabled. In that case...

PT-2026-79647

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in ump to endpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

PT-2026-79684

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f ncm: Use unsigned int for ndp index The variable ndp index is declared as a signed integer, but it stores the return value of get ncm, which is unsigned. A malicious host can supply a large offset that overflows th...

PT-2026-79628

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free stranded TX buffers on ring deinit aq vec deinit drains the TX rings with a single aq ring tx clean call, which frees at most AQ CFG TX CLEAN BUDGET 256 descriptors and stops at hw head, which no longer moves...

PT-2026-79723

In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlink nl reload doit calls devlink netns get, which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not...

PT-2026-79695

In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ism dev exit A ism interrupt handler can be active in parallel with ism dev exit, accessing freed data structures. No new interrupts will be generated after unregister ieq. Drain ongoing...

PT-2026-79598

In the Linux kernel, the following vulnerability has been resolved: sched ext: Take cgroup lock first in scx cgroup lock scx cgroup lock write-locks scx cgroup ops rwsem and then takes cgroup lock, which can deadlock through kernfs: scx enable/disable cgroup rmdir cpu.weight write...

PT-2026-79672

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packet parse headers resets the MAC header only for a SOCK RAW frame whose socket did not bind a protocol. A protocol-bound SOCK RAW socket, any SOCK DGRAM frame...

PT-2026-79675

In the Linux kernel, the following vulnerability has been resolved: ipvs: stop estimator after disabled calc phase IPVS estimator kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If network namespace teardown clears ipvs-enable during that phase, i...