PT-2026-90328

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parse ntfs boot sector decoded them into an s64. A crafted high-bit value could therefore becom...

PT-2026-90362

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount ceph dirty folio takes a wrbuffer claim on each newly dirtied folio: it bumps i wrbuffer ref taking an ihold on the 0-1 transition and attaches the snap context to...

PT-2026-90390

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4 ff encode layoutget The XDR buffer size calculation in nfsd4 ff encode layoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memor...

PT-2026-90302

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes ata scsi write same xlat translates a SCSI WRITE SAME command with the UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM descriptor is buil...

PT-2026-90329

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size...

PT-2026-90335

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GET REPORT response to the caller buffer quickspi hid raw request receives the caller's buffer length in len, but quickspi get report never sees it and copies the whole device-supplied...

PT-2026-90339

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hid hw stop Quiesce device IO at the start of the devm cleanup callback mcp2221 hid unregister so that incoming HID reports cannot race with hardware teardown during probe failure or device...

PT-2026-90322

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject too-small tag 70 packets ecryptfs parse tag 70 packet subtracts fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixe...

PT-2026-90318

In the Linux kernel, the following vulnerability has been resolved: erofs: skip sufficiently large global buffers when resizing z erofs gbuf nrpages is advanced only after every global buffer has been grown. If a resize fails after some buffers were enlarged, a retry revisits those enlarged...

PT-2026-90340

In the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universal pidff probe starts the device with hid hw start and then, if force-feedback initialisation fails, returns the error through a label that only does...

PT-2026-90315

In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicm probe registers the display before initializing ddata-lock. Once omapdss register display publishes the display, another consumer can reach a dsicm...

PT-2026-90333

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIR PAGE ENTRY ends in a page lcns array whose length is the on-disk lcns follow field. check rstbl validates the table bookkeeping but never checks that this array fits in t...

PT-2026-90307

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocket ioctl submit job releases rjob through rocket job put on allocation error paths. rocket job cleanup unconditionally calls rocket iommu domain putjob-domain, but...

PT-2026-90296

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf get stack get perf callchain returns a per-CPU perf callchain entry buffer and releases its recursion slot via put callchain entry before returning, so nothing keeps the entry reserved while bpf get...

PT-2026-90352

In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce-tgthint in free tgts When free tgts frees all structures in ce-tlist, ce-tgthint is left pointing to one of the freed cache dfs tgt structures. If ce-tgthint is not reset before it is used later, it results ...

PT-2026-90327

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfs attr update meta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressed size field before the name and...

PT-2026-90323

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject oversized encrypted key size in parse tag 3 packet parse tag 3 packet set encrypted key size from the Tag 3 packet body without bounding it against ECRYPTFS MAX KEY BYTES 64. When encrypted key size 64, decrypt...

PT-2026-90313

In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: unregister connector callback on init failure uvesafb init registers the v86d connector callback before registering the platform driver. If platform driver register fails, the function returns the error directly a...

PT-2026-90330

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcn empty bits per page is sized from vol-nr clusters at mount, but ntfs cluster alloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

PT-2026-90337

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221 raw event mcp2221 raw event never validates the size of incoming HID reports. In the MCP2221 I2C GET DATA path it trusts the device-supplied data3 as the copy length without checking...