PT-2026-121993

In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access access ok checks untagged addruaddr, but arch futex atomic op inuser and futex atomic cmpxchg inatomic hand the raw uaddr to the inline asm amoswap/amoadd/.../lr.w+sc....

PT-2026-121974

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpu userq get doorbell index pins any BO passed as doorbell handle into the doorbell domain. For a regular BO, TTM moves it with ttm bo move null and its contents ar...

PT-2026-121973

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate mount busy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

PT-2026-121972

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mnt change mountpoint umount mnt resets -overmount of the parent when it unmounts the mount that overmounts it. mnt change mountpoint doesn't. It moves the mount to its new parent a...

PT-2026-121962

In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivot root path pivot root reads the parents of new root and of the caller's root and checks whether they are shared before it checks that either mount is in the caller'...

PT-2026-122054

In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception FNHE is only created if the kernel c...

PT-2026-122043

In the Linux kernel, the following vulnerability has been resolved: can: dev: init can skb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skb reset mac header/skb reset network header/ skb reset transport header calls from...

PT-2026-122025

In the Linux kernel, the following vulnerability has been resolved: gve: fix napi disable deadlock when attempting to disable XSK pools When disabling XSK pools, GVE calls the unlocked versions of napi disable and napi enable. However, the netdev lock has already been acquired before ndo bpf is...

PT-2026-122042

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guarantee active cpus With commit 2125c0034c5d "cgroup/cpuset: Make cpuset hotplug processing synchronous", the cpuset hotplug operation becomes synchronous. That commit also removes the...

PT-2026-122018

In the Linux kernel, the following vulnerability has been resolved: ip6 gre: remove obsolete ERSPAN PMTU update A tc tunnel key action can attach a METADATA IP TUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspan tunnel xmit treats tha...

PT-2026-122023

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the buf state and its attached buffer should be freed. In the case of AF XDP ZC, the XSK buffer was not freed, leading to a...

PT-2026-122027

In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio mpsse irq enable arms the poll worker before publishing it: schedule work runs before the worker is added to priv-workers. If gpio mpsse disconnect walks the list in that...

PT-2026-122061

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iterate dir takes the directory's i rwsem shared and holds it across -iterate shared. For a directory that never has an entry and is never removed the lock keeps nothing still...

PT-2026-121894

In the Linux kernel, the following vulnerability has been resolved: net: emac: move setting of netops to fix crash fixes the following crash on driver initialization: |BUG: Kernel NULL pointer dereference on read at 0x00000158 |Faulting instruction address: 0xc0566b40 |Oops: Kernel access of bad...

PT-2026-121892

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef "netfs: Fix folio queue ENOMEM in writeback by adding a mempool" added a mempool for the folio queues and made the request, subrequest and folio...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.2. It arises because ioconnectbpfpopulate fills the CONNECT filter field only when addrlen is at least 28 bytes; however, IPv6 connection paths accept addresses with a SIN6LENRFC2133 value of 24 bytes. When addrlen is 24, the filter sees n...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.15. It stems from bonding failing to release old BPF program references when replacing XDP, potentially leading to BPF program leakage...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.9. It stems from xfs’s improper handling of the reflink flag during swap mapping, causing subsequent writes to shared blocks not to be performed via copy-on-write. This may result in corruption of other files sharing those blocks...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.6. It arises when, without a valid send port, original skb data is not freed during broadcast transmission. As a result, memory allocated for the skb and its socket cannot be released, potentially leading to memory leaks...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.13. It stems from riscv futex failing to remove user pointers from labels prior to atomic access; as a result, atomic operations target unvalidated tagged addresses. This may allow non-privileged processes to perform atomic read-modify-wri...