PT-2026-121911

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Drop unnecessary PMD page copy when freeing On a box with a discrete GPU, lockdep reports a possible deadlock as soon as kswapd shrinks the TTM page pool. The immediate cause is an x86 commit that added an mmap read lock ...

PT-2026-121893

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free UAF issue exists in the ovl do mkdir function when CONFIG OVERLAY FS DEBUG is enabled. The function prints the input dentry using %pd after calling vfs mkdir. However, v...

PT-2026-121922

In the Linux kernel, the following vulnerability has been resolved: flow dissector: avoid u16 truncation of hlen in bpf flow dissect bpf flow dissect sanitizes the offsets returned by the BPF program with clamp tu16, ..., hlen. If hlen is bigger than 65535, the upper bound is truncated before the...

PT-2026-121969

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree may copy tree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no...

PT-2026-122032

In the Linux kernel, the following vulnerability has been resolved: tcp: reject net iov in zerocopy receive mapping hints After copying a readable prefix, receive fallback to copy asks tcp zerocopy set hint for skb where page mapping can resume. If the next skb is unreadable, find next mappable...

PT-2026-121973

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate mount busy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

PT-2026-121851

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stale rcu barrier call within the br multicast dev del function causes extreme RTNL Routing Netlink pressure. This issue occurs because the rcu barrier was a remnant from when call rcu...

PT-2026-121932

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash io uring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfs uring encoded data in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. io uring does not free driver PDU...

PT-2026-122038

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the brcmfmac WiFi driver during P2P device removal. When the driver is removed while a user space process that created the P2P device such as wpa supplicant is...

PT-2026-122023

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the buf state and its attached buffer should be freed. In the case of AF XDP ZC, the XSK buffer was not freed, leading to a...

Red Hat: CVE-2026-98871: kernel: crypto: ccp - Fix possible deadlock in SEV init failure path

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix possible deadlock in SEV init failure path sevplatforminithandleinitexpath calls rmpmarkpagesfirmware with locked=false while the parent function of initexpath already acquired the sevcmdmutex. In the case of an...

PT-2026-121862

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm scmi firmware component where the notification parser fails to validate the payload size of BASE ERROR EVENT. This event contains a variable number of message...

PT-2026-121929

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: disable rx napi when removing device Unloading the mt7915e module with a MT7916 triggers multiples WARN in netif napi del locked and in page pool disable direct recycling because the driver does not disable th...

PT-2026-121980

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthor drv.c:panthor ioctl group create, the queue count is validated against the hardcoded maximum: if !args-queues.count || args-queues.cou...

PT-2026-122040

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let data start run past the buffer struct dm ioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dm ioctl, data, is seven bytes shorter than sizeofstru...

PT-2026-121849

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The isofs component fails to properly handle set blocksize failures. This occurs because isofs utilizes buffer heads, which do not effectively manage block sizes exceeding PAGE SIZE...

PT-2026-122059

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached MMIO information. Both the fill and validation paths use kvm memslot...

PT-2026-121869

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter ipset component regarding the improper marking of RCU Read-Copy-Update locked areas. Specifically, the RCU lock is unnecessarily held when incrementing t...

PT-2026-122061

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iterate dir takes the directory's i rwsem shared and holds it across -iterate shared. For a directory that never has an entry and is never removed the lock keeps nothing still...

Linux kernel DoS

The vulnerability of the r8712initxmitpriv function in the drivers/staging/rtl8712/rtl871xxmit.c file and the r8712xmitresourcealloc function in the drivers/staging/rtl8712/xmitlinux.c file of the Linux kernel is related to insufficient resource management during its existence. Exploiting this...