PT-2026-90324

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfs parse packet set receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGE SIZE - 8. For version 1 headers the packet set starts...

PT-2026-90059

In the Linux kernel, the following vulnerability has been resolved: sysctl: move the "cad pid" entry from pid table to kern reboot table cad pid is global, and kill cad pid is only used in the root namespace. However, due to pid table root permissions, a non-root user can unshare pid/user...

PT-2026-90062

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtio vsock remove stops the virtqueues and then flushes each work item before freeing the enclosing virtio vsock. The current order does not account for dependencies between those...

PT-2026-90180

In the Linux kernel, the following vulnerability has been resolved: power: supply: twl4030 charger: cancel workers via devm bci is devm-allocated. Two workers bci-work and bci-current worker dereference it. twl4030 bci remove disables charging and masks interrupts. It cancels neither worker. A...

PT-2026-90172

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Propagate partial completion length across ERP recovery dasd default erp postaction copies the timing and device state from the finished ERP request back to the original request but drops proc bytes. A request that was...

PT-2026-90146

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Propagate SMU errors and validate S2D address amd stb s2d init discards the return value of several S2D SMU commands. When the SMU refuses a command e.g. "SMU cmd failed. err: 0xff" the failure is only notic...

PT-2026-90083

In the Linux kernel, the following vulnerability has been resolved: i3c: master: adi: initialize the lock before enabling interrupts adi i3c master probe requests the IRQ and unmasks REG IRQ PENDING CMDR before the controller's IBI state, transfer queue list and transfer queue lock are initialize...

PT-2026-90126

In the Linux kernel, the following vulnerability has been resolved: net: l2tp: do not propagate multicast notification errors The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail while allocating or encodi...

PT-2026-90099

In the Linux kernel, the following vulnerability has been resolved: ALSA: mpu401: Check card index validity at probe mpu401 driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe...

PT-2026-90174

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Do not complete a failed ESE read as successful dasd int handler completes an NRF read of an unallocated ESE track by calling ese read and unconditionally marking the request DASD CQR SUCCESS. dasd eckd ese read can...

PT-2026-90176

In the Linux kernel, the following vulnerability has been resolved: s390/cpum cf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpu cf events at first event...

PT-2026-90088

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cache replay, the writeback worker and the GC worker bounds its length by PCACHE SEG SIZE - seg off, the raw segment size rather than the data...

PT-2026-90074

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmd node-data buf. Several callers pass stack-allocated objects there. If wait event interruptible...

PT-2026-90194

In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctp rcv resolves the transport once per packet and leaves it in chunk-transport. The lookup reference, or the one sctp add backlog takes if the socket is owned by userspace, keeps ...

PT-2026-90218

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Free cpu buffer::free page with subbuf order When sub-buffers use an order greater than 0, cpu buffer-free page is allocated with subbuf order. Use the correct order for cpu buffer-free page...

PT-2026-90210

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlm mig lockres handler A node receiving a DLM MIG LOCKRES message trusts several fields of the peer-supplied dlm migratable lockres without validation. num locks and lockname len are bounded only on th...

PT-2026-90236

In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's pick next task operates on all sibling rqs under one acquisition of the shared core-wide lock. A -pick task that releases the rq lock leaves every...

PT-2026-90153

In the Linux kernel, the following vulnerability has been resolved: platform/x86: int1092: Fix potential memory leak in sar probe The memory allocated for device mode info in parse package called by sar get data is not freed in some of the error paths in sar probe. Fix that by converting to use...

PT-2026-90225

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdma counter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdma counter using rdma zalloc drv obj" requires drivers implementing counter ops to embed struct rdma counter in...

PT-2026-90364

In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in ceph parse deleg inos ceph parse deleg inos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...