PT-2026-121964

In the Linux kernel, the following vulnerability has been resolved: namespace: look at the topmost mount for a mount namespace file attach recursive mnt preallocates a mountpoint for the root of the topmost mount of the source so that a mount that already sits at the destination can be put on top...

PT-2026-121878

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the microchip sparx5 network driver where the sparx5 tc flower psfp setup function fails to release allocated PSFP stream gate, flow meter, and stream filter resources...

PT-2026-121987

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the Bluetooth RFCOMM implementation. The rfcomm recv data function passes a socket buffer skb to the d-data ready callback. While the tty implementation correctly...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.13. It stems from improper serialization of concurrent access to hcon-scodata by scorecvscodata and scoconnfree within Bluetooth SCO, potentially leading to use-after-free conditions...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions from 6.6.48 up to and including 6.6.160, as well as version 6.7. This vulnerability stems from the mt7603 driver failing to initialize its queue prior to releasing global station WCID. Frames injected via the monitor interface are processed...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.6.160, 6.12.113, 6.18.57, and 7.2.11. This vulnerability stems from the failure to release excess xarray nodes within clearinode, potentially leading to memory leaks...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.12. It stems from the failure to reject netiov fragments in the TCP zero-copy receive mapping prompt; canmapfrag dereferences a NULL value returned by skbfragpage, potentially leading to null pointer dereferencing and kernel crashes...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.8. It arises when the mt7915e module responsible for MT7916 is uninstalled without first disabling the rx napi prior to terminating it; this may lead to system instability...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.10. It arises because after removing matchall entries via sparx5tcmatchalldestroy, no memory is freed, resulting in a memory leak when deleting mirror and goto matchall filters...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.19. It arises because maycopytree accepts root nsfs or pidfs files for mounting prior to checking whether they are already mounted; this allows the entire un-mounted mount tree to be copied under MSREC or ATRECURSIVE...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.0. It stems from initcanskb failing to restore the initialization of the skb header, causing the macheader field of RX skb generated by functions such as alloccanskb to be set to 0xFFFF. This results in an overflow during length calculatio...

Linux kernel security vulnerabilities

Security vulnerabilities exist in Linux kernel versions from 6.12.114 up to 6.13, 7.1.8 up to 7.2, and 7.2. These stem from skipping the allocationhooks wrapper when directly invoking the -alloc callback of mempool, resulting in current-alloctag not being set and allocation lacking proper tags...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.16. It arises because amt devices’ buffers of skb objects reference the original pointers within their skb-cb fields. When these buffers are released due to a tunnel expiration, subsequent enqueuing operations trigger reuse after release i...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.12. It stems from a race condition related to route notification sizes. When the nexthop compatibility mode is enabled, concurrent replacement may increase the group size between independent snapshots. This causes fibdumpinfo to return...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions 4.0.2 through 4.1. It arises because pathpivotroot fails to verify whether a mount is within the caller’s mount namespace prior to reading newroot and accessing its parent mount point; this may lead to use-after-free conditions...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions from 4.1.43 up to but not including 4.2, from 4.4.78 up to but not including 4.5, from 4.9.39 up to but not including 4.10, from 4.11.12 up to but not including 4.12, from 4.12.3 up to but not including 4.13, and specifically in version 4.1...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.12. It arises because schedext fails to requeue tasks on the queue when the CPU goes offline; as a result, these tasks remain counted and cannot be awakened by hotplug threads, leading to CPU hotplug hangs or offline stalls...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.1. It stems from holding an inode lock for too long when reading from an immutable directory. Attackers can delay the getdents response via FUSE mounting, thereby blocking directory lookup, creation, and mounting operations, leading to a...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.10. It arises because cipsov4skbuffdelattr fails to adjust the cache offset of subsequent options when removing CIPSO bytes. This may result in accessing incorrect bytes and causing packet data to be interpreted as option length, which is...

PT-2026-121971

In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mount lock statmount mnt basic reads the ids of the parent through m-mnt parent with namespace sem held for reading. That's fine for a mount that is in a namespace. Everythin...