Linux kernel Resource Control Compromise

The vulnerability of the Linux operating system’s kernel is related to insufficient control over resources during its existence. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information...

Linux kernel DoS

The vulnerability of the r8712initxmitpriv function in the drivers/staging/rtl8712/rtl871xxmit.c file and the r8712xmitresourcealloc function in the drivers/staging/rtl8712/xmitlinux.c file of the Linux kernel is related to insufficient resource management during its existence. Exploiting this...

Linux kernel batadv_interface_rx() Buffer Overflow

The vulnerability of the batadvinterfacerx function in the net/batman-adv/soft-interface.c component of the Linux kernel is related to the improper implementation of the control flow. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility ...

Linux kernel Resource Control Compromise

The vulnerability of the Linux operating system’s kernel is related to insufficient control over resources during its existence. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information...

Linux kernel Bluetooth mgmt_add_adv_patterns_monitorComplete msft_le_monitor_advertisementCB Do

The vulnerability of the mgmtaddadvpatternsmonitorComplete function in the net/bluetooth/mgmt.c component and the msftlemonitoradvertisementcb function in the net/bluetooth/msft.c component of the Linux kernel is related to the implementation of incorrect flow control. Exploiting this vulnerabili...

PT-2026-122041

In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipso v4 skbuff delattr removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a...

PT-2026-121918

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4 irq disable masks the V3D interrupt sources and then calls synchronize irq before the V3D is powered down. However, by itself, this is not enough to quiesce the...

PT-2026-122063

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dm integrity resume re-reads the superblock from the device so that it picks up the flags and the recalculate position. It performs no validation on the result, while the constructo...

PT-2026-121995

In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIG SHADOW CALL STACK, handle exception reloads the kernel shadow call stack pointer gp only when the trap came from userspace. It made that decision wit...

PT-2026-121997

In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594-regulator: Fix n linear ranges for TPS65224 BUCK2-4 The TPS65224 BUCK2, BUCK3 and BUCK4 descriptors pass 4 as n linear ranges, but tps65224 bucks 2 3 4 ranges only has two entries, covering selectors 0x00-0x45...

PT-2026-122020

In the Linux kernel, the following vulnerability has been resolved: ice: fix metadata dst refcount handling on representor teardown ice eswitch release repr uses metadata dst free to release the representor's metadata dst. metadata dst free directly frees the underlying memory without checking th...

PT-2026-122031

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipc topsrv stop closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could...

PT-2026-122033

In the Linux kernel, the following vulnerability has been resolved: strparser: make sure strp recv isn't running before tearing down the parser The comment above strp done claims that if strp is stopped, strp recv will no longer be called. That's only true if the caller has a mechanism eg locking...

PT-2026-122045

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify dao clear left,right input functions" centralized the DAO input mapper clearing logic in dao clear input, but omitted the...

PT-2026-122062

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in sched cpu wait empty until nothing else is left, and the only thing that wake...

PT-2026-122043

In the Linux kernel, the following vulnerability has been resolved: can: dev: init can skb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skb reset mac header/skb reset network header/ skb reset transport header calls from...

PT-2026-121902

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix IRQ injection with SIGP Stop and Store Status When inject sigp stop is called for a Stop and Store Status operation, if the vCPU is running, the interrupt is marked as pending and the status is stored by the thread...

PT-2026-121915

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Clean up locking This cleans up several issues with locking behavior, including RCU accesses not being guarded behind a lock...

PT-2026-121910

In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to request irq With commit ba268514ea14 "rust: devres: fix race condition due to nesting", Devres::new returns Result by value instead of initializing in-place via PinInit. Because...

Red Hat: CVE-2026-98872: kernel: freevxfs: don't BUG() on unknown typed-extent type

In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG on unknown typed-extent type vxfsbmaptyped handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from...