PT-2026-121899

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM arm64 nested virtualization implementation regarding the life cycle of the nested mmus array, which stores shadow page tables used during nested contexts. When...

PT-2026-121961

In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir, unlink and rename call dont mount on the victim and then detach mounts with the victim's inode locked. do lock mount takes the inode lock of the mountpoint an...

PT-2026-121875

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdkfd component during CRIU restore. The function set queue properties from criu fails to call kfd queue acquire buffers, resulting in the buffer fields of...

PT-2026-121978

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xe i2c notifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xe i2c client work then...

PT-2026-122005

In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed only in the completion...

PT-2026-121904

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the EDAC/altera component. In the altr edac a10 device add and altr portb setup functions, the error path frees the dci structure before releasing the...

PT-2026-122001

In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized optee probe called tee device register on both the client and the supplicant device before the rest of struct optee had been initialized. tee device register calls cdev devi...

PT-2026-121944

In the Linux kernel, the following vulnerability has been resolved: cxgb4/ch ktls: disable softirqs around tid list erases chcr ktls cpl act open rpl inserts into tid list from the receive path using xa insert bh. The array is shared by the adapter's connections and initialized with XA FLAGS LOCK...

PT-2026-121928

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ASoC adau1372 driver where the gpiod set value function is used for powerdown GPIOs. This causes a warning when the GPIO provider, such as I2C controlled GPIO...

PT-2026-122022

In the Linux kernel, the following vulnerability has been resolved: ibmveth: h free logical LAN on open-fail after register ibmveth open registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out free buffer pools without h free logical lan, so PHYP still owns the...

Red Hat: CVE-2026-98873: kernel: netfilter: nf_conntrack_expect: zero at allocation time

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackexpect: zero at allocation time There are occasional LLM hints wrt. leaking uninitialized data to userspace via ctnetlink. Just zero at allocation time, expectations are not frequently used these days...

PT-2026-122002

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand datapath flows hit a soft lockup inside a single netlink flow dump and panicked. ovs flow cmd dump calls ovs flow stats get f...

PT-2026-121996

In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices ch readconfig looks up the scsi device of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in ch-dt. scsi device...

PT-2026-122004

In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero dev queue xmit result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port or the mode transmi...

PT-2026-122051

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 "net: ipv4: Cache pmtu for all packet paths if multipath enabled" made ip rt update pmtu update every path. For nexthop objects, fib info num path and fib info n...

PT-2026-121857

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the wifi mac80211 hwsim component where the hwsim tx info frame received nl function casts the HWSIM ATTR TX INFO payload to a hwsim tx rate structure and reads...

PT-2026-121886

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nl80211 module of the wifi subsystem where the system fails to validate if a link is beaconing before attempting a color change. This can lead to the driver being...

PT-2026-121992

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where rebinding an HCI socket after its controller is unregistered can lead to a race condition with monitor control replay, potentially crashi...

PT-2026-122019

In the Linux kernel, the following vulnerability has been resolved: io uring/net: populate CONNECT filter fields for 24-byte sockaddr in6 io connect bpf populate fills connect.port and connect.v6 addr for AF INET6 only when addr len = sizeofstruct sockaddr in6, i.e. 28 bytes. The IPv6 connect pat...

PT-2026-122007

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb copy and csum bits When skb copy and csum bits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The calle...