CVE-2026-99246

In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock The tipcnoderesetlinks trace event asks tipcnodedump to walk the node's link entries. Unlike the other node events that request link data, this event runs without the node lock...

PT-2026-136079

In the Linux kernel, the following vulnerability has been resolved: io-wq: order the exit bit against worker creation task work io wq exit workers cancels task work for queued worker creation with task work cancel match. That has a plain load of task-task works. io queue worker create adds the ne...

PT-2026-136084

In the Linux kernel, the following vulnerability has been resolved: i2c: xiic: restore non-managed runtime PM to fix clk WARN flood The devres conversion replaced manual pm runtime enable/disable with devm pm runtime set active enabled and dropped the remove-time runtime PM teardown. The managed...

PT-2026-136102

In the Linux kernel, the following vulnerability has been resolved: io uring/zcrx: fix buffer offsets in areas above 4GB io zcrx queue cqe computes the offset of the buffer in its area from net iov idx, which is an unsigned int, so the shift is done in 32 bits and only the result is widened to th...

PT-2026-136096

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix resident conversion in ntfs new attr flags When setting sparse/compressed flags on a resident attribute, the function skipped the resident-to-non-resident conversion and terminated...

PT-2026-136103

In the Linux kernel, the following vulnerability has been resolved: io uring/napi: make stale entries time out after 60s With dynamic tracking a NAPI id that hasn't been seen for a minute is meant to be dropped from the list the ring busy polls. The timeout is added to jiffies, but it is defined ...

PT-2026-136123

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.2 Description A use-after-free issue exists in the TCP request socket timer handler. When TCP socket migration fails at the inet ehash insert function within reqsk timer handler, the system may free the new...

PT-2026-136095

In the Linux kernel, the following vulnerability has been resolved: soc/tegra: pmc: Fix uninitialised clock rate For legacy 32-bit Tegra devices, the warning in the tegra pmc enter suspend mode function is being triggered because the early pmc-rate variable is never configured and hence, always 0...

kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in etsqdiscchange [email protected] says: The vulnerability is a race condition between etsqdiscdequeue and etsqdiscchange. It leads to UAF on stru...

kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI Universal Asynchronous Receiver/Transmitter UART driver. When the hciregisterdev function fails, a flag indicating protocol initialization is not properly cleared. This oversight allows incoming UART data to be process...

kernel: net: bridge: use a stable FDB dst snapshot in RCU readers

A flaw was found in the Linux kernel. Inconsistent handling of local Forwarding Database FDB entries in the bridge networking component's RCU Read-Copy-Update readers can lead to a null-pointer dereference. A local attacker could exploit this by triggering a concurrent update to an FDB entry,...

kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq

A flaw was found in the Linux kernel's Wacom Human Interface Device HID driver. This vulnerability allows a remote attacker to trigger an out-of-bounds read by sending a specially crafted, short Bluetooth HID report. This can lead to the disclosure of sensitive information from the system's memor...

kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express input/output control ioctl handling. An unprivileged local user could exploit this vulnerability by bypassing access checks in the NVMEIOCTLSUBMITIO function. This allows them to perform unauthorized I/O operations on a...

kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could exploit this by sending a specially crafted COOKIEECHO chunk to a listening SCTP server. The server's failure to properly validate the length of a cached peer INIT chunk within...

CVE-2026-99237

A flaw was found in the Linux kernel's tracing subsystem. A race condition exists due to missing locking when resetting trace data during concurrent reader operations. A local attacker with access to tracing interfaces can exploit this vulnerability by performing concurrent file operations,...

Exploit for CVE-2026-98432

CVE-2026-98432 Mitigation & Audit Script Automated audit, hot...

CVE-2026-98432: A Remote Use-After-Free in the Linux Kernel's TCP Stack

Learn about CVE-2026-98432, a critical remote use-after-free flaw in the Linux kernel TCP stack, its root exploit risks, affected versions, and mitigation steps...

CVE-2026-99239

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol L2CAP subsystem. A race condition between concurrent socket bind and connect operations allows a communication channel to be attached to a connection multiple times. A local attacker can exploit this fla...

CVE-2026-99240

A flaw was found in the Linux kernel's Data Access Monitor DAMON subsystem. A local user can trigger a division-by-zero error by configuring a monitoring scheme with a quota target value of zero. This failure can cause the kernel to crash, resulting in a Denial of Service DoS...

CVE-2026-99217

A flaw was found in the Linux kernel. A race condition during process creation cleanup can cause an internal deadlock when a process creation operation fails while closing an associated file descriptor. A local user could exploit this vulnerability to cause a Denial of Service DoS by preventing n...