Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.8. It stems from improper rejection of automatic mounts under mount points that are not owned by the caller. countmounts dereferences an invalid pointer within MNTNSINTERNAL, potentially leading to null pointer dereferencing and a kernel...

PT-2026-121959

In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount d alloc pseudo hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHE NORCU and dentry free frees them righ...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.2. It stems from a failure in pathsfrominode within scrubprintwarninginode, which fails to release references obtained via btrfsgetfsroot. This results in a localroot reference leak...

PT-2026-121968

In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mnt notify add puts a mount on notify list. It doesn't check whether the mount is on the list already. That's fine as long as every mount is queued at most once per...

PT-2026-122010

In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packet rcv spkt packet rcv spkt restores the link layer header with skb pushskb, skb-data - skb mac headerskb; That subtraction is only meaningful when the device actually has a link layer...

PT-2026-121960

In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switch task namespaces and copy namespaces and dropped...

PT-2026-121925

In the Linux kernel, the following vulnerability has been resolved: devlink: fix devlink rel reference leak when notify work is pending devlink rel nested in notify work schedule takes a reference on the devlink rel for the notify work and then queues the work, ignoring the return value of schedu...

PT-2026-122036

In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thread, A, runs. While it's running, the second one, B, gets partw...

PT-2026-121915

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Clean up locking This cleans up several issues with locking behavior, including RCU accesses not being guarded behind a lock...

PT-2026-121923

In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin user regset copyin only copies count bytes, so a PTRACE SETREGSET request with a short iov len leaves the rest of the stack buffer uninitialized. In riscv vr set that...

PT-2026-121935

In the Linux kernel, the following vulnerability has been resolved: btrfs: always return -EIOCBQUEUED after btrfs uring read extent endio If all bios finish before btrfs encoded read regular fill pages returns, it calls btrfs uring read extent endio and previously returned the I/O status. A...

PT-2026-121997

In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594-regulator: Fix n linear ranges for TPS65224 BUCK2-4 The TPS65224 BUCK2, BUCK3 and BUCK4 descriptors pass 4 as n linear ranges, but tps65224 bucks 2 3 4 ranges only has two entries, covering selectors 0x00-0x45...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.6. It stems from macsec failing to initialize SecY prior to registering a netdevice. During registration, notifications may report uninitialized SecY attributes including SCI, and warnings are triggered when keylen is zero...

PT-2026-121951

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A bug exists in the XFS file system implementation of the XFS IOC EXCHANGE RANGE control operation when the TO EOF flag is used. The issue occurs because the code incorrectly swaps the...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.10. It stems from improper handling of the TOEOF flag in XFSIOCEXCHANGERANGE; this results in an incorrect swap of file sizes between disk and memory. As a consequence, shared blocks beyond EOF remain present, and the reflink flag is...

PT-2026-122017

In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix add key race with keyring restriction key create or update snapshots keyring-restrict link before taking the destination keyring's semaphore. keyring restrict installs a restriction while holding that semaphore. This...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, and 6.18.53. This vulnerability stems from isofs failing to handle setblocksize errors; the bufferheads it uses cannot properly handle block sizes larger than PAGESIZE. During mountin...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions 5.9.13 through 5.10. It arises because packetrcvspkt fails to check whether a link layer header exists on a device when restoring it; as a result, devices lacking a visible link layer header trigger skbunderpanic, leading to a kernel crash...

PT-2026-122029

In the Linux kernel, the following vulnerability has been resolved: selinux: preserve NATIVE LABELS on already-initialized sb in set mnt opts When an NFSv4 filesystem exported with security label is mounted a second time, sget fc returns the existing superblock and nfs get root calls security sb...

PT-2026-121902

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM s390 architecture during IRQ injection for Stop and Store Status operations. When the inject sigp stop function is called while the vCPU is already stopped, th...