PT-2026-79660

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qcom-geni UART driver where flushing the transmit buffer during an ongoing TX DMA Direct Memory Access causes the UART to infinitely repeat corrupted TX DMA frames...

PT-2026-79711

In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocation of auxr dev fails during auxiliary device setup, the error path calls auxiliary device uninit, which eventually invokes bnge aux dev release. The release...

PT-2026-79616

In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msg iter before TLS 1.3 optimistic retry tls decrypt sg advances msg-msg iter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application...

PT-2026-79684

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f ncm: Use unsigned int for ndp index The variable ndp index is declared as a signed integer, but it stores the return value of get ncm, which is unsigned. A malicious host can supply a large offset that overflows th...

PT-2026-79656

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtw get wpa ie rtw get wpa ie reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short...

PT-2026-79644

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: re-anchor capture URBs on resubmission capture urb complete resubmits each capture URB without anchoring it: usb get urburb; ret = usb submit urburb, GFP ATOMIC; Anchoring is a property of a submission, not of th...

PT-2026-79670

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdp buff. If an XDP program adjusts the fragment area, bpf prog run generic xdp copies xdp frags size back t...

PT-2026-79658

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NXP LPC32xx UART PORT LPC3220 where an RX character-timeout interrupt can be latched while the RX FIFO is empty. In this state, the Interrupt Identification Regist...

PT-2026-79704

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix memory leak in exec queue set hang replay state The q-replay state is blindly overwritten, which can potentially leak memory that was previously allocated by vmemdup user. Return an error if q-replay state is not empt...

PT-2026-79590

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound the DROM dual link port number before indexing sw-ports tb drom parse entry port validates the device-supplied header-index against sw-config.max port number before indexing sw-ports, but the sibling field...

PT-2026-79696

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Tear down DMA paths before stopping the rings tbnet tear down stops both rings and frees their frame buffers before calling tb xdomain disable paths. tb ring stop zeroes the ring's descriptor base and tbnet free...

PT-2026-79672

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packet parse headers resets the MAC header only for a SOCK RAW frame whose socket did not bind a protocol. A protocol-bound SOCK RAW socket, any SOCK DGRAM frame...

PT-2026-79675

In the Linux kernel, the following vulnerability has been resolved: ipvs: stop estimator after disabled calc phase IPVS estimator kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If network namespace teardown clears ipvs-enable during that phase, i...

PT-2026-79698

In the Linux kernel, the following vulnerability has been resolved: net: prestera: validate firmware header length prestera fw hdr parse reads the firmware header before checking that the firmware image contains that header. Reject images shorter than struct prestera fw header before decoding the...

PT-2026-79695

In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ism dev exit A ism interrupt handler can be active in parallel with ism dev exit, accessing freed data structures. No new interrupts will be generated after unregister ieq. Drain ongoing...

PT-2026-79629

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct-lock is still held. When invalid logging is routed to nfnetlink log and conntrack export is enabled,...

PT-2026-79709

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch cake: drop WARN ON1 for malformed packets in ACK filter The sch cake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARN ON1 which...

PT-2026-79699

In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSI CMD SEND CMD payload length ncsi send cmd nl takes the number of bytes to copy from the attacker-controlled ncsi pkt hdr.length field of the in-band packet header, while the source buffer is th...

PT-2026-79686

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuf len against rxbuf len in bulk msg ibuf len is the bulk IN receive buffer size, but the EMSGSIZE check in usbio bulk msg compares it against txbuf len — the bulk OUT endpoint size. Both are taken...

PT-2026-79650

In the Linux kernel, the following vulnerability has been resolved: mm/damon/lru sort: error out for 10000 active mem bp damos quota score can trigger division by zero if the target value is zero. DAMON LRU SORT lets users set the target value for the hot memory scheme via active mem bp parameter...