PT-2026-79619

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b "vsock/virtio: add support for device suspend/resume" made the run flags transition from false to true when restore installs replacement virtqueues. The RX, TX...

PT-2026-79635

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6 dev get from resurrecting inet6 dev in6 dev get reads dev-ip6 ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these...

PT-2026-79708

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Validate T10 PI scatterlist counts When T10 PI is negotiated, vhost-scsi splits protection bytes from the data iterator before mapping the request scatterlists. A malformed request can claim protection bytes that cove...

PT-2026-79691

In the Linux kernel, the following vulnerability has been resolved: rqspinlock: Reset tail when preserving queue on deadlock Currently, the destruction of the waiter queue is suppressed for rqspinlock in cases where a deadlock is detected. Deadlock checks happen relatively frequently on entry for...

PT-2026-79643

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Serialize the scheduler timeout handlers V3D exposes several independent hardware queues BIN, RENDER, TFU and CSD but has only a single, global reset. A timeout on any one queue therefore has to stop, reset and restart t...

PT-2026-79626

In the Linux kernel, the following vulnerability has been resolved: net/sched: act ct: fix sk buff leak when the header checks reject a packet tcf ct handle fragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTO IPV4 err = tcf ct ipv4 i...

PT-2026-79639

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ring buffer subbuf order set frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rb advan...

PT-2026-79608

In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: Fix board ID over-read The EEPROM board ID is a fixed 13-byte field and is not guaranteed to contain a NUL terminator. Passing it directly to devlink info version fixed put treats it as a C string and may read beyond th...

PT-2026-79655

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the WMM param handler function within the rtl8723bs staging driver. The function copies a fixed-size WMM parameter element from a received information...

PT-2026-79704

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix memory leak in exec queue set hang replay state The q-replay state is blindly overwritten, which can potentially leak memory that was previously allocated by vmemdup user. Return an error if q-replay state is not empt...

PT-2026-79695

In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ism dev exit A ism interrupt handler can be active in parallel with ism dev exit, accessing freed data structures. No new interrupts will be generated after unregister ieq. Drain ongoing...

PT-2026-79634

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmb clientid arr A dibs device interrupt handler can be active after dibs dev del and may still access dmb clientid arr. UAF In case of a failure in dibs dev add being called by dibs lo dev probe dmb...

PT-2026-79716

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbus notify, the code unconditionally casts every attribute to a struct sensor device attribute: drivers/hwmon/pmbus/pmbus...

PT-2026-79596

In the Linux kernel, the following vulnerability has been resolved: mm/filemap: filemap add folio restore index before retrying In filemap add folio's split-a-conflict loop, xas set order is applied repeatedly: each application modifies xas.xa index, rounding it down according to the split order...

PT-2026-79686

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuf len against rxbuf len in bulk msg ibuf len is the bulk IN receive buffer size, but the EMSGSIZE check in usbio bulk msg compares it against txbuf len — the bulk OUT endpoint size. Both are taken...

PT-2026-79679

In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zap pte range reclaims a page table, it does: pte free tlbtlb, pmd pgtablepmdval, addr; and this is unconditionally wrong: if this code executes, addr always point...

PT-2026-79644

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: re-anchor capture URBs on resubmission capture urb complete resubmits each capture URB without anchoring it: usb get urburb; ret = usb submit urburb, GFP ATOMIC; Anchoring is a property of a submission, not of th...

PT-2026-79690

In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Clamp negative current limits When a negative value is passed to ltc4282 write curr, the signed long val is cast directly to u64: drivers/hwmon/ltc4282.c:ltc4282 write curr / need to pass it in millivolt / u32 in =...

PT-2026-79660

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qcom-geni UART driver where flushing the transmit buffer during an ongoing TX DMA Direct Memory Access causes the UART to infinitely repeat corrupted TX DMA frames...

PT-2026-79636

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smc rx splice smc rx splice passes pages to splice to pipe before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splice to pipe may...