PT-2026-79690

In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Clamp negative current limits When a negative value is passed to ltc4282 write curr, the signed long val is cast directly to u64: drivers/hwmon/ltc4282.c:ltc4282 write curr / need to pass it in millivolt / u32 in =...

PT-2026-79660

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qcom-geni UART driver where flushing the transmit buffer during an ongoing TX DMA Direct Memory Access causes the UART to infinitely repeat corrupted TX DMA frames...

PT-2026-79711

In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocation of auxr dev fails during auxiliary device setup, the error path calls auxiliary device uninit, which eventually invokes bnge aux dev release. The release...

PT-2026-79706

In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in key extract When a packet arrives on an ARPHRD NONE device e.g. TUN, ovs flow key extract trusts the user-provided skb-protocol field: if it is ETH P TEB, the packet is classified ...

PT-2026-79601

In the Linux kernel, the following vulnerability has been resolved: fs,fsverity: remove check for fsverity being enabled in setattr prepare The check that fs-verity is available in the kernel is not necessary here. Filesystems could have fsverity files even without fs-verity enabled. In that case...

PT-2026-79636

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smc rx splice smc rx splice passes pages to splice to pipe before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splice to pipe may...

PT-2026-79661

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fib nhc update mtu fib nhc update mtu walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcu dereference protected with a...

PT-2026-79628

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free stranded TX buffers on ring deinit aq vec deinit drains the TX rings with a single aq ring tx clean call, which frees at most AQ CFG TX CLEAN BUDGET 256 descriptors and stops at hw head, which no longer moves...

PT-2026-79693

In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctp make heartbeat ack caches the destination transport in chunk-transport without taking a reference. When src out of asoc ok is enabled, the HEARTBEAT ACK may remain...

PT-2026-79731

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primary is promisc under RTNL in bond alb monitor bond alb monitor reads primary is promisc under RCU, then drops RCU and takes RTNL via rtnl trylock before undoing the promiscuity it set on the active slav...

PT-2026-79687

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs data ep set params sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urb packs; u-buffer size = maxsize u-packets; if fmt-fmt...

PT-2026-79676

In the Linux kernel, the following vulnerability has been resolved: ima: fix out-of-bounds read in xattr verify The digest-length check in xattr verify mixes int and size t: if xattr len - sizeofxattr value-type - hash start = iint-ima hash-length sizeof yields size t, so the usual arithmetic...

PT-2026-79615

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext sk msg ring unpushed When the copy path in tls sw sendmsg locked adds the fragment that fills the plaintext sk msg ring, it does not set full record, so the record is left full and unpushed. A...

PT-2026-79614

In the Linux kernel, the following vulnerability has been resolved: tipc: read le-link under the node lock in tipc node link down tipc node link down caches the link pointer before taking n-lock: struct tipc link l = le-link; / unlocked / if !l return; tipc node write lockn; if !tipc link is...

PT-2026-79668

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the network scheduler where overly deep qdisc queueing discipline hierarchies can cause excessive recursion in qdisc tree walkers. This recursion can lead to the...

PT-2026-79593

In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk-transport in step with the list it is queued on sctp outq flush rtx moves a gap-acked chunk onto another transport's transmitted list without updating chunk-transport: if chunk-tsn gap acked list move...

PT-2026-79683

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179 178a: fix skb leak in ax88179 tx fixup When the interface has NETIF F SG enabled and skb linearize fails in ax88179 tx fixup, the function returns NULL without freeing the skb. usbnet start xmit treats a NULL...

PT-2026-79647

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in ump to endpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

PT-2026-79723

In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlink nl reload doit calls devlink netns get, which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not...

PT-2026-79617

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the veth driver where non-linear skb fragments are exposed through an xdp buff. When an XDP program adjusts the fragment area, the veth xdp rcv skb function fails to...