PT-2026-79628

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free stranded TX buffers on ring deinit aq vec deinit drains the TX rings with a single aq ring tx clean call, which frees at most AQ CFG TX CLEAN BUDGET 256 descriptors and stops at hw head, which no longer moves...

PT-2026-79731

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primary is promisc under RTNL in bond alb monitor bond alb monitor reads primary is promisc under RCU, then drops RCU and takes RTNL via rtnl trylock before undoing the promiscuity it set on the active slav...

PT-2026-79687

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs data ep set params sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urb packs; u-buffer size = maxsize u-packets; if fmt-fmt...

PT-2026-79676

In the Linux kernel, the following vulnerability has been resolved: ima: fix out-of-bounds read in xattr verify The digest-length check in xattr verify mixes int and size t: if xattr len - sizeofxattr value-type - hash start = iint-ima hash-length sizeof yields size t, so the usual arithmetic...

PT-2026-79615

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext sk msg ring unpushed When the copy path in tls sw sendmsg locked adds the fragment that fills the plaintext sk msg ring, it does not set full record, so the record is left full and unpushed. A...

PT-2026-79614

In the Linux kernel, the following vulnerability has been resolved: tipc: read le-link under the node lock in tipc node link down tipc node link down caches the link pointer before taking n-lock: struct tipc link l = le-link; / unlocked / if !l return; tipc node write lockn; if !tipc link is...

PT-2026-79668

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the network scheduler where overly deep qdisc queueing discipline hierarchies can cause excessive recursion in qdisc tree walkers. This recursion can lead to the...

PT-2026-79593

In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk-transport in step with the list it is queued on sctp outq flush rtx moves a gap-acked chunk onto another transport's transmitted list without updating chunk-transport: if chunk-tsn gap acked list move...

PT-2026-79683

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179 178a: fix skb leak in ax88179 tx fixup When the interface has NETIF F SG enabled and skb linearize fails in ax88179 tx fixup, the function returns NULL without freeing the skb. usbnet start xmit treats a NULL...

PT-2026-79647

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in ump to endpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

PT-2026-79723

In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlink nl reload doit calls devlink netns get, which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not...

PT-2026-79617

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the veth driver where non-linear skb fragments are exposed through an xdp buff. When an XDP program adjusts the fragment area, the veth xdp rcv skb function fails to...

PT-2026-79689

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tap get user xdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in dev parse header protocol when skb-dev is null" fixed a crash in tap get user by assigning...

PT-2026-79735

In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs server' during a FREE STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the...

PT-2026-79712

In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata...

PT-2026-79634

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmb clientid arr A dibs device interrupt handler can be active after dibs dev del and may still access dmb clientid arr. UAF In case of a failure in dibs dev add being called by dibs lo dev probe dmb...

PT-2026-79598

In the Linux kernel, the following vulnerability has been resolved: sched ext: Take cgroup lock first in scx cgroup lock scx cgroup lock write-locks scx cgroup ops rwsem and then takes cgroup lock, which can deadlock through kernfs: scx enable/disable cgroup rmdir cpu.weight write...

PT-2026-79690

In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Clamp negative current limits When a negative value is passed to ltc4282 write curr, the signed long val is cast directly to u64: drivers/hwmon/ltc4282.c:ltc4282 write curr / need to pass it in millivolt / u32 in =...

PT-2026-79660

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qcom-geni UART driver where flushing the transmit buffer during an ongoing TX DMA Direct Memory Access causes the UART to infinitely repeat corrupted TX DMA frames...

PT-2026-79711

In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocation of auxr dev fails during auxiliary device setup, the error path calls auxiliary device uninit, which eventually invokes bnge aux dev release. The release...