PT-2026-122033

In the Linux kernel, the following vulnerability has been resolved: strparser: make sure strp recv isn't running before tearing down the parser The comment above strp done claims that if strp is stopped, strp recv will no longer be called. That's only true if the caller has a mechanism eg locking...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.6. It stems from a race condition wherein strprecv is not guaranteed to stop running prior to strpdone removing the parser. This may lead to use-after-free issues...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.10. It stems from the recursive cleanup of the STAREXCL port group within the brmulticastsgdelexcludeports function in network bridging. This results in a large number of STAREXCL ports, each consuming one kernel stack frame; this may lead...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.20. It arises because bpfflowdissect fails to enforce hlen to U16MAX prior to clamping it when processing offsets returned by BPF programs. If hlen exceeds 65535, it is truncated to U16MAX, causing nhoff and thoff to be forced to zero. Thi...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.2. It stems from the mmc mtk-sd driver failing to properly cancel request timeouts upon removal; the timeout callback continues to access host-devcomp after mmchost is freed, allowing reuse of the device after release...

PT-2026-122041

In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipso v4 skbuff delattr removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a...

PT-2026-121957

In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. step into step into rechecks d seq and follow mount rcu rechecks mount lock. An entry that gets unlinked in between caus...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.0. It arises because statmountmntbasic reads a parent mount that has been unmounted while it does not hold a mountlock; in concurrent release scenarios, it may reference a released mount, leading to use-after-free conditions...

Linux kernel security vulnerabilities

A security vulnerability exists in the Linux kernel. It stems from the isinv2mode function in cgroup/cpuset, which may use an expired pointer when accessing cpusetcgrpsubsys.root, potentially leading to use-after-free conditions...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.17. It arises when the XSK buffer is not freed after an error bit in a descriptor is set by RX, potentially leading to a buffer leak...

PT-2026-122052

In the Linux kernel, the following vulnerability has been resolved: rust binder: reschedule node refcount update on thread exit When a thread exits via BINDER THREAD EXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferr...

Linux kernel DoS

The vulnerability of the r8712initxmitpriv function in the drivers/staging/rtl8712/rtl871xxmit.c file and the r8712xmitresourcealloc function in the drivers/staging/rtl8712/xmitlinux.c file of the Linux kernel is related to insufficient resource management during its existence. Exploiting this...

Linux kernel Resource Control Compromise

The vulnerability of the Linux operating system’s kernel is related to insufficient control over resources during its existence. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information...

PT-2026-122038

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmf detach When the driver is removed while the user space process that created the P2P device e.g. wpa supplicant is still exiting, the P2P device interface is removed twice and t...

PT-2026-121920

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum flower: Fix port range register leak in tmplt create mlxsw sp flower tmplt create parses a flow cls offload template into a stack-local struct mlxsw sp acl rule info purely to compute rulei.values.elusage. Parsing...

PT-2026-121946

In the Linux kernel, the following vulnerability has been resolved: net/sched: em text: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a "net/sched: fix potential stack infoleak in em text dump", which zero-initialised the dump-side struct. Sashiko pointed at a...

PT-2026-122032

In the Linux kernel, the following vulnerability has been resolved: tcp: reject net iov in zerocopy receive mapping hints After copying a readable prefix, receive fallback to copy asks tcp zerocopy set hint for skb where page mapping can resume. If the next skb is unreadable, find next mappable...

PT-2026-122040

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let data start run past the buffer struct dm ioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dm ioctl, data, is seven bytes shorter than sizeofstru...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.7. It stems from the use of a user-writable TPA register in handleexception within RISC-V entry handling to determine whether an exception originates from user space. Attackers can manipulate this register to cause the kernel to bypass...

PT-2026-122046

In the Linux kernel, the following vulnerability has been resolved: Input: ati remote2 - fix type confusion in device attribute handlers Previously, the channel mask and mode mask attributes were registered on the parent usb device via sysfs create group. When commit b20d6bf8014b "Input:...