PT-2026-72783

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nf ct timeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being us...

PT-2026-72813

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like num sge or...

PT-2026-72814

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in get srq wqe get srq wqe reads wqe-dma.num sge from the shared receive queue buffer, which is mapped into userspace. It validates num sge against max sge, but then re-reads the same field to...

PT-2026-72815

In the Linux kernel, the following vulnerability has been resolved: dax/kmem: account for partial discontiguous resource upon removal When dev dax kmem probe partially succeeds at least one range is mapped but a subsequent range fails request mem region or add memory driver managed, the probe...

PT-2026-72841

In the Linux kernel, the following vulnerability has been resolved: OPP: Fix race between OPP addition and lookup A race exists between dev pm opp add dynamic and dev pm opp find freq exact: CPU0 add CPU1 lookup ------------------------------- ------------------------------ opp add mutex lock lis...

PT-2026-72809

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix bio accounting for split md cloned bios Use md cloned bio to control bio accounting instead of relying on r1bio existed in raid1 or the io accounting flag in raid10. The previous logic does not reliably refle...

PT-2026-72860

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vc data fbcon new modelist runs when a framebuffer's modelist changes. For each console mapped to it with fb displayi.mode set, it reads vc consi.d and passes the vc num t...

PT-2026-72956

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initialize timer A userspace-driven ALSA timer SND UTIMER lets an unprivileged user set the backing snd timer's hardware resolution to an arbitrary 64-bit value via SNDRV TIMER IOCTL CREATE. snd...

PT-2026-72943

In the Linux kernel, the following vulnerability has been resolved: of/address: Fix NULL bus dereference in of pci range parser one The bus matching rework made of match bus return NULL for nodes with ranges/dma-ranges but no local address-cells. parser init stored that NULL bus, and the range...

PT-2026-72950

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill max is set When a USB audio endpoint requests full packet transfers via the fill max descriptor flag, data ep set params promotes ep-curpacksize to ep-maxpacksize...

PT-2026-72942

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid use-after-free in poll trace queue dumps TIPC socket tracepoints dump queue state through tipc sk dump. Most queue-dump callsites already serialize that walk under the socket lock or sk-sk lock.slock, but tipc poll...

PT-2026-72949

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode snd usb handle sync urb scales received sync packet sizes by the sender's stride and stores the result directly in out packet-packet sizei. If a connected USB device sen...

PT-2026-72968

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if L2 is active and KVM is using a separate MSR bitmap to run L2. If AVIC is...

PT-2026-72978

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix potential deadlock in mpi3mr fault uevent emit mpi3mr fault uevent emit runs from the fault watchdog and reset paths where host I/O may already be blocked. GFP KERNEL allocations here, both the local kzalloc obj...

PT-2026-72276

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfc sli4 driver resource setup The memory allocated for mboxq using mempool alloc is not freed in some of the early exit error paths. Fix that by moving the mempool free call to an earlier point...

PT-2026-72308

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcm tx lock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there, mirroring the approach already used in bcm rx setup. Only copy the...

PT-2026-72654

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounded peek rpcrdma is bcall decodes a reply's first words to decide whether the frame is a backchannel call. Two issues in that decode path let a short or malformed reply leak the receive buff...

PT-2026-72682

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Replace waitqueue and flag with completion The driver previously used a waitqueue along with an explicit request done flag, but without proper barriers around request done. An earlier patch by Gui-Dong Han attempted t...

PT-2026-72676

In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdw add element group count found by syzkaller The original implementation caused an out-of-bounds memory access in the sdw add element group count for-loop when i == num. for i = 0; i ratesi && lane ==...

PT-2026-72688

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt re: Free SRQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt qplib destroy srq won't write the toggle values to an already-fre...