PT-2026-72627

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writes pending leak on write request failures raid10 make request acquires a writes pending reference with md write start before dispatching write requests. Several failure paths in raid10 write request complete th...

PT-2026-72604

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft compat: ebtables emulation must reject non-bridge targets xtables targets return netfilter verdicts: NF ACCEPT, NF DROP, and so on. ebtables targets return incompatible verdicts: EBT ACCEPT, EBT DROP, ... We cannot...

PT-2026-72607

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf nat: avoid invalid nat net pointer use on failed nf nat init We ran into below KASAN splat, which is mostly uninteresting, beside for having nf nat register fn in the call chain as a cause for the offending access:...

PT-2026-72575

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix potential invalid pointer deref in group process tiler oom If heaps is an ERR PTR, panthor heap pool put will deref an invalid pointer. Make sure we set it to NULL in that case...

PT-2026-72562

In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incomi...

PT-2026-72600

In the Linux kernel, the following vulnerability has been resolved: s390/mm: Fix handling of PAGE UNUSED pte bit The PAGE UNUSED softbit should not really be lying around. Its sole purpose is to signal to try to unmap one and try to migrate one that the page can be discarded instead of being move...

PT-2026-72560

In the Linux kernel, the following vulnerability has been resolved: afs: Fix lack of locking around modifications of net-cells dyn ino Fix the lack of locking around modifications of net-cells dyn ino by taking net-cells lock exclusively. This also requires to cell to be removed from net-cells dy...

PT-2026-72569

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistent id race the fp-owner.name compare-read in ksmbd vfs compare durable owner against th...

PT-2026-72594

In the Linux kernel, the following vulnerability has been resolved: net: sungem: fix probe error cleanup gem init one calls gem remove one when register netdev fails. gem remove one unregisters and frees resources owned by the net device, including the DMA block, MMIO mapping, PCI regions, and th...

PT-2026-72641

In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cache ops-populate callback, and if cache operations include an exit callback, the error code from...

PT-2026-72625

In the Linux kernel, the following vulnerability has been resolved: md/raid1: free r1 bio when REQ NOWAIT is set and read would block on retry When a read is retried, raid1 read request may be called with a pre-allocated r1 bio. If wait read barrier fails for a REQ NOWAIT read, the bio is complet...

PT-2026-72620

In the Linux kernel, the following vulnerability has been resolved: tpm crb: Check ACPI COMPANION against NULL during probe Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device match driver override, so platform drivers that rely on the...

PT-2026-72609

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore error route in local/main tables. When CONFIG IP MULTIPLE TABLES is enabled but no rule is added, fib lookup performs route lookup directly on two tables. Since the first lookup does not properly bail out,...

PT-2026-72670

In the Linux kernel, the following vulnerability has been resolved: gpib: fix double decrement of descriptor busy in command ioctl commit d1857f8296dc "gpib: fix use-after-free in IO ioctl handlers" introduced a descriptor busy reference counter to pin struct gpib descriptor across IO ioctl...

PT-2026-72700

In the Linux kernel, the following vulnerability has been resolved: net: watchdog: fix refcount tracking races Blamed commit converted the untracked dev hold/dev put calls in the watchdog code to use the tracked dev hold track/dev put track which were later renamed/interfaced to netdev hold and...

PT-2026-72684

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt re: Proper rollback if the ioremap fails bnxt qplib alloc dpi returns success even if ioremap fails. Add the proper rollback when the ioremap fails and return -ENOMEM status...

PT-2026-72699

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: check skb clone in control TX t7xx port ctrl tx clones each skb fragment before passing it to the port transmit path. The clone is used immediately to set cloned-len, so an skb clone failure results in a NULL...

PT-2026-72681

In the Linux kernel, the following vulnerability has been resolved: net: serialize netif running check in enqueue to backlog Syzbot reported a KASAN slab-use-after-free in fib rules lookup. The root cause is a race condition where packets can escape the backlog flushing during device unregistrati...

PT-2026-72679

In the Linux kernel, the following vulnerability has been resolved: net/9p: fix race condition on rdma-state in trans rdma.c The rdma-state field is modified without holding req lock in both recv done and p9 cm event handler, while rdma request accesses the same field under the req lock spinlock...

PT-2026-72698

In the Linux kernel, the following vulnerability has been resolved: kcm: use WRITE ONCE when changing lower socket callbacks kcm attach replaces a live lower TCP socket's sk data ready and sk write space callbacks with KCM handlers, and kcm unattach restores them later. Those callback-pointer...