Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.12.34, from 6.15.3 up to but including 6.16, and specifically in version 6.16. This vulnerability stems from the failure of vsock/virtio’s readskb to properly count unread bytes after receiving part of a stream...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.14. It stems from the failure of the drm/fb-helper to delay initialization when fbdevprobe fails, resulting in an old modeset being submitted even when modeset-fb is empty, thereby triggering a WARNON!set-fb...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.12. It arises because when a RFCOMM tty is closed, rfcommdevshutdown fails to check whether dev-ttydev is null. When rfcommdevadd fails to register a tty device, dev-ttydev remains uninitialized, potentially leading to a null pointer...

Linux kernel security vulnerabilities

A security vulnerability exists in the Linux kernel. It stems from mac80211’s ieee80211rxmgmtdeauth function, which fails to validate the length of deauthentification frames prior to reading the deauthentification reason code; this may lead to an out-of-bounds read...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, and 6.18.53. This vulnerability arises because thunderbolt hotplug events may continue processing functions even after their associated domains have been removed from the domain...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 5.15.222, 6.1.189, 6.6.158, 6.12.111, and 6.18.53. This vulnerability stems from the failure to validate the size of valid payloads for SENSORUPDATE; the parser does not verify that received payloads contain expected sensor reading...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, and 6.18.53. This vulnerability stems from a reversal in the logic used by sndseqossread when checking for the next event and the remaining user-space buffer; it may result in read...

PT-2026-121854

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the MMC core where the max segs field, which is an unsigned short, can be truncated to zero if a host driver provides an excessively large value. This leads to mmc all...

PT-2026-121907

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An information leak exists in the kernel due to padding holes in the rtc wkalrm structure following the pending member. When this structure is returned to userspace through the RTC WKALR...

Red Hat: CVE-2026-98876: kernel: host1x: bus: Fix missing ops null check in error teardown

In the Linux kernel, the following vulnerability has been resolved: host1x: bus: Fix missing ops null check in error teardown In host1xdeviceinit, the error teardown paths do not check client-ops before dereferencing it, unlike the forward init paths which correctly guard with 'client-ops &&'. Th...

PT-2026-121863

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm scmi firmware component where the parser fails to verify that the received payload for SENSOR UPDATE contains the expected number of sensor readings derived fr...

PT-2026-121982

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the i915 graphics driver between the intel rps boost function reading the ACTIVE state and the queuing of rps-work. This race window allows rps work to be...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.4. It stems from a race condition in the brcmfdetach function of the brcmfmac driver when removing P2P devices. If a user-space process exits while the driver is being removed, it may result in the P2P device interface being removed again...

PT-2026-121885

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the video-i2c media component where the driver incorrectly uses the video unregister device function during driver removal. Because the driver utilizes vb2 fop release...

PT-2026-121919

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmci transport recv dgram cb During the closure of a datagram socket, the vmci transport recv dgram cb function may be called, which will add the packets to the socket's backlog; then, after the receive...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.6.160, 6.12.114, 6.18.58, and 7.2.12. This vulnerability arises because krb5authenticate fails to account for work-nextsmb2rsphdroff when calculating outlen. When SMB2SESSIONSETUP is processed as a non-head element within a...

PT-2026-121981

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/imagination component where page table preallocation is incorrectly sized. The pvr mmu op context create function uses an exclusive end and an incorrect offset...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions from 4.1.40 up to but not including 4.2, from 4.4.54 up to but not including 4.5, from 4.9.15 up to but not including 4.10, from 4.10.3 up to but not including 4.11, and specifically in version 4.11. This vulnerability arises because dcache...

Linux kernel security vulnerabilities

Security vulnerabilities exist in Linux kernel versions from 4.4.114 up to 4.5, from 4.9.79 up to 4.10, and from 4.14.16 up to 4.15. These vulnerabilities arise because flowdissector performs a u16 truncation on skb-len when calculating thoff; this results in the transmission header offset being...

PT-2026-121864

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amd/ras component where the CPER ring overflow handling trusts the parsed entry size from the current ring contents when advancing the read pointer rptr. Corru...