PT-2026-72172

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential deadlock in f2fs balance fs When the f2fs filesystem space is nearly exhausted, we encounter deadlock issues as below: INFO: task A:1890 blocked for more than 120 seconds. Tainted: G O 6.12.41-g3fe07ddf05ab 1...

PT-2026-72233

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix stack buffer overflow in multichannel session-key copy Commit 4b706360ffb7 "ksmbd: fix multichannel binding and enforce channel limit" moved the binding-path session key out of the session-wide sess-sess key CIFS KEY...

PT-2026-72237

In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix cas ctl leak on spi async failure ca8210 spi transfer allocates cas ctl with kzalloc objGFP ATOMIC and relies entirely on the SPI completion callback ca8210 spi transfer complete to free it. The spi async...

PT-2026-72199

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: rebind mm mempolicy to effective mems, not mems allowed Creating a child cpuset where cpuset.mems is never set leads to a div/0 when a VMA mempolicy with MPOL F RELATIVE NODES rebinds in response to a CPU hotplug...

PT-2026-72286

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix a possible NULL pointer dereference Fix a possible NULL pointer dereference dm verity loadpin is bdev trusted if the device has no table...

PT-2026-72875

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry device pasid table teardown zeroes the 128-bit scalable-mode context entry with context clear entry while the Present bit is still set. This creates a...

PT-2026-72289

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix a bug if the bio is out of limits If dm integrity check limits fails, the code would exit with DM MAPIO KILL. However, the range would be already locked at this point, and it wouldn't be unlocked, resulting in a...

PT-2026-72358

In the Linux kernel, the following vulnerability has been resolved: 9p: skip nlink update in cacheless mode to fix WARN ON v9fs dec count unconditionally calls drop nlink on regular files, even when the inode's nlink is already zero. In cacheless mode the client refetches inode metadata from the...

PT-2026-72544

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs issue read Fix missing release of credits in the failure path in cifs issue read lest retrying the subreq just overwrites the credits value...

PT-2026-72240

In the Linux kernel, the following vulnerability has been resolved: net: ip6 tunnel: require CAP NET ADMIN in the device netns for changelink ip6 tnl changelink operates on at most two netns, dev netdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns...

PT-2026-72542

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfs write mft block maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlist element under ni-runlist.lock, drops the...

PT-2026-72292

In the Linux kernel, the following vulnerability has been resolved: dm: avoid leaking the caller's thread keyring via the table device file The refactoring in commit a28d893eb327 "md: port block device access to file" accidentally causes the caller's thread keyring to be kept alive long beyond th...

PT-2026-72231

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmi alloc recv msguser takes the temporary user reference owned by the receive message, and ipmi free recv msg drops it again. If event delivery fails after allocating receive...

PT-2026-72445

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm: fix NULL pointer dereference in graph callback When q6apm free fragments is called it frees rx data.buf/tx data.buf and sets them to NULL under graph-lock. A late DSP buffer-done response can race with this:...

PT-2026-72631

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during snd usb midi v2 create. A later setup failure can still jump to snd usb midi v2 free, which currently frees each endpoint and its...

PT-2026-72485

In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation Reject ATM traffic classes above ATM ANYCLASS in check tp. SO ATMQOS stores the supplied QoS after check qos succeeds, so accepting larger values leaves invalid...

PT-2026-72559

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFS VOLUME RM TREE is set on Fix afs insert volume into cell to set AFS VOLUME RM TREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volum...

PT-2026-72667

In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: handle I2C read errors in mma8452 read Currently, If i2c smbus read i2c block data fails but mma8452 set runtime pm state succeeds, mma8452 read returns 0. As a result, the caller mma8452 read raw assumes the...

PT-2026-72566

In the Linux kernel, the following vulnerability has been resolved: afs: Fix error code in afs extract vl addrs The error codes on these paths are only set on the first iteration through the loop. Set the correct error code on every iteration...

PT-2026-72499

In the Linux kernel, the following vulnerability has been resolved: drm/xe: free madvise VMA array on L2 flush failure xe vm madvise ioctl allocates madvise range.vmas in get vmas. After get vmas succeeds with at least one VMA, error paths must go through free vmas so the array is released before...