PT-2026-72405

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdr buf to bvec stores before writing xdr buf to bvec writes a bio vec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When th...

PT-2026-72418

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: free unfragmentable packet The caller of batadv frag send packet assume that the skb provided to the function are always consumed. But the pre-check for an empty payload or the zero fragment size returned an err...

PT-2026-72457

In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: fix potential memory leak in uvesafb probe Due to an incorrect goto label, memory allocated for modedb and modelist in uvesafb vbe init is not freed in some error paths. Fix this by updating the goto label...

PT-2026-72452

In the Linux kernel, the following vulnerability has been resolved: fbdev: tridentfb: fix potential memory leak in trident pci probe In trident pci probe, the memory allocated for modelist using fb videomode to modelist is not freed in subsequent error paths. Fix that by calling fb destroy modeli...

PT-2026-72451

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: fix memory leak in snd sof load topology When the topology filename contains "dummy" and tplg cnt is 0, the function returns -EINVAL directly without freeing the tplg files allocated by kcalloc at line 2497...

PT-2026-72310

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcm rx setup when updating timer and filter content while bcm rx handler, bcm rx timeout...

PT-2026-72289

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix a bug if the bio is out of limits If dm integrity check limits fails, the code would exit with DM MAPIO KILL. However, the range would be already locked at this point, and it wouldn't be unlocked, resulting in a...

PT-2026-72286

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix a possible NULL pointer dereference Fix a possible NULL pointer dereference dm verity loadpin is bdev trusted if the device has no table...

PT-2026-72292

In the Linux kernel, the following vulnerability has been resolved: dm: avoid leaking the caller's thread keyring via the table device file The refactoring in commit a28d893eb327 "md: port block device access to file" accidentally causes the caller's thread keyring to be kept alive long beyond th...

PT-2026-72364

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: put stats for scheme add dirs internal error damon sysfs scheme add dirs setup the tried regions directory after the stats directory setup is completed. When the tried regions directory setup is failed, th...

PT-2026-72390

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid heap allocation for free-cluster readahead state get nr free clusters allocates a temporary file ra state before it publishes the precomputed free cluster count, sets NVolFreeClusterKnown, and wakes vol-free waitq. If...

PT-2026-72370

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: fix refcount leak in is full charged In is full charged, power supply get by name is called to obtain a reference to the fuel gauge power supply. If the voltage check uV = desc-fullbatt uV succeeds...

PT-2026-72369

In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASK OFFSTACK memory corruption This patch addresses a critical memory management flaw. When CONFIG CPUMASK OFFSTACK is enabled, cpumask var t is a pointer. Consequently, sizeofnew mask evaluates to the pointe...

PT-2026-72374

In the Linux kernel, the following vulnerability has been resolved: ntfs: make system files immutable to prevent corruption When a system file such as $Bitmap is exposed via show sys files and written from userspace, the volume is corrupted and, because the cluster allocator scans $Bitmap through...

PT-2026-72284

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Make dma fence dedup array robust against 0-count input dma fence dedup array returns 1 when called with num fences == 0: the for-loop body never executes, j stays at 0, and the final return ++j yields 1. This...

PT-2026-72358

In the Linux kernel, the following vulnerability has been resolved: 9p: skip nlink update in cacheless mode to fix WARN ON v9fs dec count unconditionally calls drop nlink on regular files, even when the inode's nlink is already zero. In cacheless mode the client refetches inode metadata from the...

PT-2026-72389

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index entries on reading Validate index entries immediately after reading an index root or index block from disk. This eliminates repeated checks in lookup and readdir, and reduce the risk of missing checks in thos...

PT-2026-72340

In the Linux kernel, the following vulnerability has been resolved: tpm: tpm tis spi: Use wait woken in wait for tmp stat wait event interruptible timeout evaluates its condition after setting the current task state to TASK INTERRUPTIBLE. With CONFIG DEBUG ATOMIC SLEEP this triggers a warning whe...

PT-2026-72308

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcm tx lock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there, mirroring the approach already used in bcm rx setup. Only copy the...

PT-2026-72305

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device removal RX: an RX SETUP update! for an existing op skipped can rx register unconditionally, even when a concurrent NETDEV UNREGISTER had already torn down its registration op-rx reg dev ...