Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.2. It arises when the dm-integrity device sets the SBFLAGDIRTYBITMAP flag and activates it in ‘R’ mode; as a result, the dmintegrityresume function attempts to read logs containing bitmaps, potentially leading to null pointer dereferencing...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions from 4.14.104 up to but not including 4.15, from 4.19.26 up to but not including 4.20, from 4.20.13 up to but not including 4.21, from 4.14.226 up to but not including 4.15, from 4.19.181 up to but not including 4.20, and version 5.0. This...

PT-2026-122007

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb copy and csum bits When skb copy and csum bits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The calle...

PT-2026-122009

In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc getname smc getname dereferences smc-clcsock without holding clcsock release lock. Link-group termination can release the CLC socket through smc close active abort while the SMC socket is...

PT-2026-121952

In the Linux kernel, the following vulnerability has been resolved: xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset 0 to i disk size, xmi can exchange reflink flags assumes every mapping moved and hands the reflink flag over to the other...

PT-2026-121909

In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf event open currently gates perf allow kernel only on !attr.exclude kernel. However, users can still request kernel callchain collection with attr.exclude...

PT-2026-122035

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current pwq deref in chained work check current wq worker only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker-current pwq is populated...

PT-2026-121889

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In 64-bit Linux kernels on parisc architecture, an insufficient default kernel stack size can lead to kernel crashes and panics. This issue occurs when the kernel stack overflows,...

PT-2026-121975

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove callback This driver stores struct th1520 hdmi in platform drvdata, but th1520 dw hdmi remove was reading it back as struct dw hdmi and passing it to dw hdmi remove, so teardown runs on the...

PT-2026-122060

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5 authenticate In krb5 authenticate, out len is calculated to determine available headroom in response buf for the incoming Kerberos AP-REP token. However, when SMB2 SESSION SETUP is...

PT-2026-121884

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the ATOM command table nesting depth is not capped. This is addressed by limiting nesting to 32 levels using execute depth and returning...

PT-2026-121931

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfs dir item item that packs multiple xattrs and then we replace the value of one of them with the setxattr2 family of syscalls with another...

PT-2026-121965

In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPEN TREE NAMESPACE open treeOPEN TREE NAMESPACE creates a new mount namespace from a copy of the tree at the given path. The caller needs to be privileged over its current user namespace...

PT-2026-121865

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/mlx5 HWS component where deleting a table that has a miss table created via the mlx5hws table set default miss function does not properly remove the table from...

PT-2026-121876

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the lan966x fdma reload function where the RX state is not fully restored following a reload failure. While the function backs up rx-page pool and rx-fdma, it fails to...

PT-2026-121983

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/i915/gem component where the eb relocate parse slow function can overstep the exec array boundary. This occurs when eb copy relocations allocates copies for ex...

PT-2026-121977

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xe bo pin external and xe bo unpin external support nested pins, since the underlying ttm bo pin/ttm bo unpin maintain a pin count refcount rather than a...

PT-2026-121850

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The ntfs3 driver fails to properly handle set blocksize failures. The driver utilizes buffer heads, which do not adequately support block sizes larger than PAGE SIZE. This issue can lead...

PT-2026-121986

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcomm mutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

PT-2026-121882

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA sequencer OSS interface where the snd seq oss read function uses an inverted check when verifying if the next queued event fits within the remaining userspace...