PT-2026-122045

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify dao clear left,right input functions" centralized the DAO input mapper clearing logic in dao clear input, but omitted the...

PT-2026-121874

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the imx mailbox component where the device may be used prematurely before the probe process is completed. This is addressed by implementing devm pm runtime enable and...

PT-2026-121861

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mac80211 wifi component where the ieee80211 rx mgmt deauth function reads the deauthentication reason code without first verifying that the fixed field is present ...

PT-2026-122039

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in read skb After a partial stream receive, rx bytes tracks the unread suffix while buf used and peer credit still cover the whole packet. virtio transport read skb dequeues that packet but...

PT-2026-121984

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/fb-helper component where the system fails to properly defer setup when the fbdev probe function fails with an error other than -EAGAIN. In the drm fb helper...

PT-2026-122006

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5 tc matchall replace allocates a struct sparx5 mall entry for every offloaded matchall filter and adds it to sparx5-mall entries. sparx5 tc matchall destroy removes the entry...

PT-2026-121866

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the thunderbolt component. Hotplug events are processed in a workqueue that can execute after the domain has been removed by the tb domain remove...

PT-2026-122047

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6 info hw flags set sizes the skb with rt6 nlmsg size and later fills it with rt6 fill node. With nexthop compatibility mode enabled, a concurrent replacement can grow the grou...

PT-2026-121900

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM arm64 implementation where pkvm init features from host handles KVM ARCH FLAG GUEST HAS SVE and KVM ARM VCPU SVE separately. Because pkvm vcpu init sve tests t...

PT-2026-121896

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where hung tasks occur when attempting to unmount a filesystem after its disk has been removed while still in use. During device removal, the function fs bdev mark dead...

PT-2026-121868

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where thermal work is scheduled even when the thermal work queue is not initialized. This occurs specifically when Dynamic Power Management DPM is disabled using the...

PT-2026-122063

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dm integrity resume re-reads the superblock from the device so that it picks up the flags and the recalculate position. It performs no validation on the result, while the constructo...

PT-2026-121958

In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink, rmdir and rename remove the entry from the filesystem, call detach mounts on the entry with the inode locked and then call d delete once the inode is unlocked...

PT-2026-121842

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the freevxfs file system where the vxfs bmap typed function fails to properly handle unknown typed-extent types. When an on-disk typed extent contains a type value other...

PT-2026-121846

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the host1x device init function, the error teardown paths fail to verify if client-ops is valid before dereferencing it. This differs from the forward initialization paths, which...

PT-2026-122058

In the Linux kernel, the following vulnerability has been resolved: bnxt en: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces: DMAR: DMA Read NO PASID Request...

PT-2026-122020

In the Linux kernel, the following vulnerability has been resolved: ice: fix metadata dst refcount handling on representor teardown ice eswitch release repr uses metadata dst free to release the representor's metadata dst. metadata dst free directly frees the underlying memory without checking th...

PT-2026-121979

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...

PT-2026-122053

In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an exception is only created in the IPv6 exception cache if the...

Linux kernel Bluetooth mgmt_add_adv_patterns_monitorComplete msft_le_monitor_advertisementCB Do

The vulnerability of the mgmtaddadvpatternsmonitorComplete function in the net/bluetooth/mgmt.c component and the msftlemonitoradvertisementcb function in the net/bluetooth/msft.c component of the Linux kernel is related to the implementation of incorrect flow control. Exploiting this vulnerabili...