PT-2026-136081

In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix key reject and link race with keyring restriction The restrict link check in key reject and link is done before taking the keyring semaphore, racing with a concurrent keyring restrict that installs the restriction while...

PT-2026-136092

In the Linux kernel, the following vulnerability has been resolved: dm cache: fix issue with background work locking dm cache used a rw semaphore for background work lock. Write locks on rw semaphores have strict owner semantics, but there was no guarantee that the process that locked background...

PT-2026-136098

In the Linux kernel, the following vulnerability has been resolved: io uring/timeout: don't lose a cancel as io-wq arms a timeout An IORING OP TIMEOUT run by io-wq, because of IOSQE ASYNC, has the same problem as poll, futex and waitid. io wq submit work looks at IO WQ WORK CANCEL once, before it...

PT-2026-136091

In the Linux kernel, the following vulnerability has been resolved: io uring/io-wq: don't hide a link from cancellations A task that exits cancels its tracked requests and waits until they are gone. io uring cancel generic looks everywhere a request can be, and goes to sleep if it found nothing t...

CVE-2026-99264

In the Linux kernel, the following vulnerability has been resolved: iouring/net: don't retry recv on uncommitted buffers Commit 41b70df5b38b "iouring/net: commit partial buffers on retry" commits ring provided buffers when a receive is going to be retried after a partial transfer, so that another...

PT-2026-136088

In the Linux kernel, the following vulnerability has been resolved: io uring/mpscq: disable preemption while pushing A push makes the node the new tail, and then links it to its predecessor. In between the queue isn't empty, but mpscq pop can't get at the node. The consumers deal with that by...

PT-2026-136094

In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hv apicid to vp index hv apicid to vp index currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP...

PT-2026-136086

In the Linux kernel, the following vulnerability has been resolved: printk: Postpone kthread startup There have been various bug reports related to SMP systems hanging on boot. The reports vary but seem to have some overlap with regard to missed IPI's during SMP setup. The reports also show that...

PT-2026-136097

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction It fixes both the move overflow and the eviction fence add for evicting these per-vm BOs...

PT-2026-136101

In the Linux kernel, the following vulnerability has been resolved: io uring/openclose: keep the lock in io pipe fixed io pipe fixed installs both ends of the pipe in the fixed file table, drops -uring lock, and copies the slot numbers to the application. If that faults, it takes the lock again a...

PT-2026-136105

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the sched ext scheduler subsystem, a race condition exists where tasks can be moved between dispatch queues DSQs while the dispatching CPU is still executing operations. Specifically,...

CVE-2026-99269

In the Linux kernel, the following vulnerability has been resolved: schedext: Wait for SCXOPSSDISPATCHING before moving tasks off DSQs A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue and hasn't cleared SCXOPSSDISPATCHING. The DSQ consume and...

PT-2026-136104

In the Linux kernel, the following vulnerability has been resolved: io uring: wake ring pollers for local task work With IORING SETUP DEFER TASKRUN completions are queued as local work, and only become CQEs when the submitter enters the kernel to wait for events. For an application that finds out...

PT-2026-136085

In the Linux kernel, the following vulnerability has been resolved: pid namespace: make zap pid ns processes freezable When the init of a pid namespace exits, zap pid ns processes waits until all other pids in the namespace are freed. A tracer outside the namespace that does not reap its traced...

PT-2026-136090

In the Linux kernel, the following vulnerability has been resolved: io uring: don't flood a cancelling task with task work io ring exit work asks each task which has used the ring to remove its tctx node, by task work, and repeats that until the list is empty. io tctx exit cb doesn't touch the no...

PT-2026-136093

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: gracefully handle no-device lookup of shared GPIOs We use platform lookup tables for shared GPIOs. This mechanism needs a struct device to work so fwnode-based lookup with no device associated currently causes a...

PT-2026-136100

In the Linux kernel, the following vulnerability has been resolved: io uring/net: don't retry recv on uncommitted buffers Commit 41b70df5b38b "io uring/net: commit partial buffers on retry" commits ring provided buffers when a receive is going to be retried after a partial transfer, so that anoth...

PT-2026-136080

In the Linux kernel, the following vulnerability has been resolved: pid namespace: prevent TIF NOTIFY SIGNAL from interrupting the reaper Since commit 7fea700e04bd "zap pid ns processes: clear TIF NOTIFY SIGNAL along with TIF SIGPENDING" zap pid ns processes clears TIF NOTIFY SIGNAL before every...

CVE-2026-99246

In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock The tipcnoderesetlinks trace event asks tipcnodedump to walk the node's link entries. Unlike the other node events that request link data, this event runs without the node lock...

CVE-2026-99270

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsktimerhandler. When TCP socket migration fails at inetehashinsert in reqsktimerhandler, we jump to the noownership: label and free the new reqsk immediately with reqskfree. Thus, we must stop the new...