PT-2026-90375

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4 client and does not keep it alive. The client survives its stateids only because destroy client drains...

PT-2026-90373

In the Linux kernel, the following vulnerability has been resolved: libceph: validate OSD extent maps before cursor advance net/ceph/osd client.c:osd sparse read validates that the sparse-read data length matches the summed extent lengths, but it does not validate that each OSD-supplied extent is...

PT-2026-90410

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOAD CANCEL path clp != NULL, manage cpntf state freed the target cpntf state without checking ownership. The lookup key st-si opaque.so id is allocated...

PT-2026-90372

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crush decode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucke...

PT-2026-90351

In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbd reopen durable fd walks the inode's m op list and rebinds every detached oplock to the reconnecting session: list for each entry rcuop, &ci-m op list, o...

PT-2026-90388

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvc decode setaclargs fills in argp-acl access only when NFS ACL is set in the request mask and argp-acl...

PT-2026-90391

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller OFFLOAD CANCEL, nfsd4 shutdown copy, nfsd4 cancel copy by sb raced the copy kthread: - find async copy bumped...

PT-2026-90370

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in check new map on session freed during unlock check new map iterates mdsc-sessions and for each active session drops mdsc-mutex to perform per-session operations. The forced-close path rank removed from map...

PT-2026-90358

In the Linux kernel, the following vulnerability has been resolved: cifs: call pagecache isize extended in cifs setsize when extending cifs setsize calls truncate pagecache but skips pagecache isize extended on extension. truncate setsize shows the correct pattern: i size writeinode, newsize; if...

PT-2026-90421

In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rq status counter to even on all nfsd dispatch exit paths nfsd dispatch sets rq status counter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a...

PT-2026-90197

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme tcp handle r2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it: nvme...

PT-2026-90459

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsm sendrecv msg locked stores the virtqueue used-ring length reported by the NSM device into msg-resp.len without bounding it to the response buffer. A malicious or buggy...

PT-2026-90092

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate geometry fields from on-disk cache info cache segs init iterates cache info-n segs times indexing cache-segments, which is sized to the cache device geometry, and get seg id takes each segment id from the...

PT-2026-90139

In the Linux kernel, the following vulnerability has been resolved: io uring/query: cap user size passed to copy struct to user io handle query entry clamps hdr.size for the inbound copy from user but keeps the original user value as usize. copy struct to user uses that usize and, when it is larg...

PT-2026-90106

In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation decap and validate pulls the outer SRv6 headers and makes the inner packet the skb network header. The IPv6 control block still contains values collected while parsing the outer packet,...

PT-2026-90080

In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesas i3c xfer, enqueues it, and waits for completion. The interrupt...

PT-2026-90057

In the Linux kernel, the following vulnerability has been resolved: timekeeping: Check the return value of tk get aux ts64 in do adjtimex If the auxiliary clock is disabled during tk get aux ts64 but is enabled before tks-clock valid is checked, then uninitialized stackdata will be used in the...

PT-2026-90400

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4 init cp state nfs4 alloc init cpntf state published the new cpntf entry into the s2s cp stateids IDR with cs type set in one s2s cp lock section, then took the lock again to list add it onto p...

PT-2026-90439

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfs direct propagate after truncation Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in nilfs direct propagate during testing. Analysis revealed that after truncating a...

PT-2026-90416

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate sockaddr length per family in listener set nfsd sock nl policy declares NFSD A SOCK ADDR as a bare NLA BINARY attribute with no minimum length. A CAP NET ADMIN caller can send a 16-byte NFSD A SOCK ADDR with sa...