PT-2026-72864

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix double unlock in rxrpc recvmsg Fix a double unlock in rxrpc recvmsg when dealing with OOB messages...

PT-2026-72854

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Fix potential tracepoint null pointer dereferences Trace dma fence signaled, trace dma fence wait end and trace dma fence destroy can all currently dereference a null fence-ops pointer after it has been reset on fence...

PT-2026-72866

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpc input ackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new servic...

PT-2026-72865

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the reception of a reply packet before data transmission Fix rxrpc receiving reply to handle the reception of an apparent reply DATA packet before rxrpc has had a chance to send any request DATA packets on a client cal...

PT-2026-72190

In the Linux kernel, the following vulnerability has been resolved: memstick: ms block: reject a card that reports too many blocks msb ftl initialize computes the zone count from the card block count with no bound: msb-zone count = msb-block count / MS BLOCKS IN ZONE; ... for i = 0; i zone count;...

PT-2026-72181

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix permanently busy scans after multiple roam iterations In order for the firmware to sleep, the driver has to confirm a previously received sleep request. The normal sequence of evets goes like this: EVENT SLEEP ...

PT-2026-72677

In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvec rx completed In nvec rx completed, when an incomplete RX transfer is detected, nvec msg free is called to return the message back to the pool by clearing its 'used' atomic flag. Immediate...

PT-2026-72782

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev//patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating...

PT-2026-72805

In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix u-a-f in luo file unpreserve files and luo file finish In luo file unpreserve files and luo file finish, reorder module put and xa erase to ensure the file handler module remains pinned while its operations are...

PT-2026-72802

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in change sta links for unready link ieee80211 set active links calls ieee80211 link use channel for each newly-added link and WARN ON ONCEs if it fails. The call uses assign on failure=true, which...

PT-2026-72808

In the Linux kernel, the following vulnerability has been resolved: raid1: fix nr pending leak in REQ ATOMIC bad-block error path In raid1 write request, each per-mirror loop iteration begins by incrementing rdev-nr pending. If a REQ ATOMIC write encounters a badblock within the requested range,...

PT-2026-72616

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack slot index in nospec checks check stack write fixed off computes the byte slot for a fixed-offset stack write as -off - 1, and records each written byte in slot type with slot - i % BPF REG SIZE. The Spectre v4...

PT-2026-72618

In the Linux kernel, the following vulnerability has been resolved: net/sched: act ct: fix nf connlabels leak on two error paths tcf ct fill params calls nf connlabels get setting put labels when TCA CT LABELS is present, but two later error sites use a bare return instead of "goto err", skipping...

PT-2026-72375

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid self-deadlock during inode eviction An attribute-list update performed while allocating clusters can drop the last reference to the temporary attribute inode. Evicting that inode drops its reference to the base inode...

PT-2026-72366

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: always put unsuccessfully committed target pids damon commit target puts and gets the destination and the source target pids. It puts the destination target pid because it will be overwritten by the source target...

PT-2026-72528

In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: fix races on the shared Super VCAP block The VCAP instances on a chip are not independent, yet they are locked independently. On sparx5 and lan969x the IS0 and IS2 instances are backed by the same Super VCAP...

PT-2026-72549

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hw engine: Fix double-free of managed BO in error path The error path in hw engine init explicitly frees a BO allocated with xe managed bo create pin map via xe bo unpin map no vm. Since the managed BO already has a devm...

PT-2026-72533

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback On failure at index i, the reverse cleanup loop in mlx5 lag create single fdb starts from i, so the failed index itself is rolled back. That can operate on uninitialized...

PT-2026-72741

In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 "bpf: Fix oob access in cgroup local storage" is still incomplete. The prog-array compatibility check treats a program with no cgroup storag...

PT-2026-72241

In the Linux kernel, the following vulnerability has been resolved: net: ip6 gre: require CAP NET ADMIN in the device netns for changelink ip6gre changelink and ip6erspan changelink operate on at most two netns, dev netdev and the tunnel link netns t-net. They differ once the device is created in...