PT-2026-72575

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix potential invalid pointer deref in group process tiler oom If heaps is an ERR PTR, panthor heap pool put will deref an invalid pointer. Make sure we set it to NULL in that case...

PT-2026-72670

In the Linux kernel, the following vulnerability has been resolved: gpib: fix double decrement of descriptor busy in command ioctl commit d1857f8296dc "gpib: fix use-after-free in IO ioctl handlers" introduced a descriptor busy reference counter to pin struct gpib descriptor across IO ioctl...

PT-2026-72258

In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rt spin unlock rt spin unlock releases the RCU protection before unlocking the lock. That opens the door for the following UAF scenario: T1 T2 spin lock&p-lock; rcu read lock;...

PT-2026-72224

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch taprio: Replace direct dequeue call with peek and qdisc dequeue peeked When taprio's software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gso skb; taprio dequeue from txq...

PT-2026-72188

In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation ip vs get out rt calls skb ensure writable which may reallocate skb-head...

PT-2026-72179

In the Linux kernel, the following vulnerability has been resolved: mtd: mchp23k256: use SPI match data for chip caps The driver stores chip capacity information in both the OF match table and the SPI id table. Probe currently uses of device get match data, so a non-OF SPI modalias match falls ba...

PT-2026-72182

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

PT-2026-72386

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject non-resident records for resident-only attributes The shared lookup-time attribute validator rejects non-resident $FILE NAME and $VOLUME NAME records because their formats require resident values and callers handle...

PT-2026-72396

In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfs ea lookup and ntfs listxattr, this verifies that there is enough space in the EA entry before accessing the next entry offset field of the EA entry...

PT-2026-72517

In the Linux kernel, the following vulnerability has been resolved: net/liquidio: drop cached VF pci dev LUT The PF SR-IOV enable path caches VF pci dev pointers in dpiring to vfpcidev lut by iterating with pci get device. Those entries do not own a reference, because the iterator drops the...

PT-2026-72611

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an opts sz argument. The verifier checks only the memory range described by opts sz, but the wrappers...

PT-2026-72628

In the Linux kernel, the following vulnerability has been resolved: md/raid1: fix writes pending and barrier reference leaks on write failures raid1 make request acquires a writes pending reference with md write start before calling raid1 write request. Several failure paths in raid1 write reques...

PT-2026-72496

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw sp port lag join When mlxsw sp port lag index get fails, mlxsw sp port lag join returns an error without releasing the lag reference obtained by the earlier mlxsw sp lag get. All other error path...

PT-2026-72424

In the Linux kernel, the following vulnerability has been resolved: s390/perf cpum cf: Add missing array index nospec to hw perf event init ev variable is userspace controlled via event-attr.config and used as an array index after bounds checking, but without speculation barriers. Add the missing...

PT-2026-72425

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/brs: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERF SAMPLE BRANCH USER is requested. On...

PT-2026-72430

In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sk socket dereference in selinux sctp bind connect selinux sctp bind connect dereferences sk-sk socket to pass a struct socket to selinux socket bind and selinux socket connect helper. However, when the hook is...

PT-2026-72392

In the Linux kernel, the following vulnerability has been resolved: ntfs: centalize $INDEX ROOT header validation Add a dedicated helper to perform stricter validation of $INDEX ROOT and use it for both directory inodes and named index inodes. This keeps the root size and header geometry checks...

PT-2026-72367

In the Linux kernel, the following vulnerability has been resolved: riscv: cacheinfo: Fix node reference leak in populate cache leaves Currently, the while loop drops the reference to prev in each iteration. If the loop terminates early due to a break, the final of node putnp correctly drops the...

PT-2026-72360

In the Linux kernel, the following vulnerability has been resolved: mm/mm init: fix uninitialized struct pages for ZONE DEVICE If DAX memory is hotplugged into an unoccupied subsection of an early section, section activate reuses the unoptimized boot memmap. However, compound nr pages still assum...

PT-2026-72404

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: Fix leak when custom dump segments addition fails Free allocated minidump region 'name' in qcom add minidump segments when failing before adding the region to 'dump segments'. Otherwise, the 'name' is not tracke...