PT-2026-136094

In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hv apicid to vp index hv apicid to vp index currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP...

PT-2026-136082

In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock The tipc node reset links trace event asks tipc node dump to walk the node's link entries. Unlike the other node events that request link data, this event runs without the node...

PT-2026-136086

In the Linux kernel, the following vulnerability has been resolved: printk: Postpone kthread startup There have been various bug reports related to SMP systems hanging on boot. The reports vary but seem to have some overlap with regard to missed IPI's during SMP setup. The reports also show that...

CVE-2026-99264

In the Linux kernel, the following vulnerability has been resolved: iouring/net: don't retry recv on uncommitted buffers Commit 41b70df5b38b "iouring/net: commit partial buffers on retry" commits ring provided buffers when a receive is going to be retried after a partial transfer, so that another...

PT-2026-136087

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Avoid infinite retry loop in init vp index There is a retry loop in init vp index where the CPUs from a certain node are stripped out if they have already been in the allocated cpumask or not in HK TYPE MANAGED IRQ...

PT-2026-136091

In the Linux kernel, the following vulnerability has been resolved: io uring/io-wq: don't hide a link from cancellations A task that exits cancels its tracked requests and waits until they are gone. io uring cancel generic looks everywhere a request can be, and goes to sleep if it found nothing t...

PT-2026-136089

In the Linux kernel, the following vulnerability has been resolved: io uring/cancel: rearm local work wake up before sleep io uring try cancel requests sets -cq wait nr to 1 so that the next io req local work add wakes the cancelling task. The add that takes the count to zero is the only one that...

CVE-2026-99261

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction It fixes both the move overflow and the eviction fence add for evicting these per-vm BOs...

CVE-2026-99259: Linux: In the Linux kernel, the following vulnerability has been resolved: soc/tegra: pmc: Fix uninitialised clock rate For…

In the Linux kernel, the following vulnerability has been resolved: soc/tegra: pmc: Fix uninitialised clock rate For legacy 32-bit Tegra devices, the warning in the tegrapmcentersuspendmode function is being triggered because the earlypmc-rate variable is never configured and hence, always 0. Thi...

PT-2026-136097

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction It fixes both the move overflow and the eviction fence add for evicting these per-vm BOs...

CVE-2026-99269

In the Linux kernel, the following vulnerability has been resolved: schedext: Wait for SCXOPSSDISPATCHING before moving tasks off DSQs A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue and hasn't cleared SCXOPSSDISPATCHING. The DSQ consume and...

PT-2026-136090

In the Linux kernel, the following vulnerability has been resolved: io uring: don't flood a cancelling task with task work io ring exit work asks each task which has used the ring to remove its tctx node, by task work, and repeats that until the list is empty. io tctx exit cb doesn't touch the no...

PT-2026-136080

In the Linux kernel, the following vulnerability has been resolved: pid namespace: prevent TIF NOTIFY SIGNAL from interrupting the reaper Since commit 7fea700e04bd "zap pid ns processes: clear TIF NOTIFY SIGNAL along with TIF SIGPENDING" zap pid ns processes clears TIF NOTIFY SIGNAL before every...

PT-2026-136093

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: gracefully handle no-device lookup of shared GPIOs We use platform lookup tables for shared GPIOs. This mechanism needs a struct device to work so fwnode-based lookup with no device associated currently causes a...

PT-2026-136100

In the Linux kernel, the following vulnerability has been resolved: io uring/net: don't retry recv on uncommitted buffers Commit 41b70df5b38b "io uring/net: commit partial buffers on retry" commits ring provided buffers when a receive is going to be retried after a partial transfer, so that anoth...

PT-2026-136101

In the Linux kernel, the following vulnerability has been resolved: io uring/openclose: keep the lock in io pipe fixed io pipe fixed installs both ends of the pipe in the fixed file table, drops -uring lock, and copies the slot numbers to the application. If that faults, it takes the lock again a...

PT-2026-136085

In the Linux kernel, the following vulnerability has been resolved: pid namespace: make zap pid ns processes freezable When the init of a pid namespace exits, zap pid ns processes waits until all other pids in the namespace are freed. A tracer outside the namespace that does not reap its traced...

PT-2026-136105

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the sched ext scheduler subsystem, a race condition exists where tasks can be moved between dispatch queues DSQs while the dispatching CPU is still executing operations. Specifically,...

PT-2026-136104

In the Linux kernel, the following vulnerability has been resolved: io uring: wake ring pollers for local task work With IORING SETUP DEFER TASKRUN completions are queued as local work, and only become CQEs when the submitter enters the kernel to wait for events. For an application that finds out...

CVE-2026-99270

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsktimerhandler. When TCP socket migration fails at inetehashinsert in reqsktimerhandler, we jump to the noownership: label and free the new reqsk immediately with reqskfree. Thus, we must stop the new...