PT-2026-121900

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Derive GUEST HAS SVE from the SVE feature bit at EL2 pkvm init features from host takes KVM ARCH FLAG GUEST HAS SVE and KVM ARM VCPU SVE from the host separately, but pkvm vcpu init sve tests the bit while vcpu has sv...

PT-2026-121895

In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremap prot Mapping a stack-top page via /dev/mem with PROT NONE and then reading that process's /proc//cmdline triggers a spurious WARN in ioremap prot through generic access phys:...

PT-2026-122018

In the Linux kernel, the following vulnerability has been resolved: ip6 gre: remove obsolete ERSPAN PMTU update A tc tunnel key action can attach a METADATA IP TUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspan tunnel xmit treats tha...

PT-2026-122022

In the Linux kernel, the following vulnerability has been resolved: ibmveth: h free logical LAN on open-fail after register ibmveth open registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out free buffer pools without h free logical lan, so PHYP still owns the...

PT-2026-122019

In the Linux kernel, the following vulnerability has been resolved: io uring/net: populate CONNECT filter fields for 24-byte sockaddr in6 io connect bpf populate fills connect.port and connect.v6 addr for AF INET6 only when addr len = sizeofstruct sockaddr in6, i.e. 28 bytes. The IPv6 connect pat...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 2.6.13. It stems from emtextchange failing to verify whether the algo array ends with NUL before passing it to textsearchprepare, potentially leading to out-of-bounds reads and kernel memory leaks...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.11. It stems from improper lifecycle management of the nestedmmus array in KVM arm64 nv; after relocation during VCPUINIT, pointers to the now-freed structure are still used, potentially leading to use-after-free conditions...

PT-2026-121874

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devm pm runtime enable sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pm runtime enable into the removal path instead doing it early. This...

PT-2026-121843

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack expect: zero at allocation time There are occasional LLM hints wrt. leaking uninitialized data to userspace via ctnetlink. Just zero at allocation time, expectations are not frequently used these days...

PT-2026-121844

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect Clearly, from a user perspective, it must be valid to configure WoWLAN and then suspend while not connected to a network. Since mac80211 doesn't distinguish these cas...

PT-2026-121845

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/gsp: add SEC2 to GA100 chip table The booter-load and booter-unload firmware run on the SEC2 falcon. During tu102 gsp oneinit, the booter constructor needs device-sec2 to access the SEC2 falcon. Without the .sec2 entr...

PT-2026-121850

In the Linux kernel, the following vulnerability has been resolved: ntfs3: handle set blocksize failures ntfs3 uses buffer heads, which don't handle block size PAGE SIZE well. Without this, mounting we will hit the BUG ONoffset = folio sizefolio; in folio set bh on the first bread gfp call...

PT-2026-121854

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided max segs The max segs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmc alloc sg to call kmalloc obj...

PT-2026-121970

In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNT UMOUNT in clone mnt MNT UMOUNT gets raised on a mount that umount tree or umount one has taken out of its namespace. It's never cleared. detach mounts unhooks a mount that carries it instead of...

Red Hat: CVE-2026-98873: kernel: netfilter: nf_conntrack_expect: zero at allocation time

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackexpect: zero at allocation time There are occasional LLM hints wrt. leaking uninitialized data to userspace via ctnetlink. Just zero at allocation time, expectations are not frequently used these days...

Red Hat: CVE-2026-98874: kernel: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect Clearly, from a user perspective, it must be valid to configure WoWLAN and then suspend while not connected to a network. Since mac80211 doesn't distinguish these cas...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions 6.5.3 through 6.6 and 6.6. This vulnerability arises because userregsetcopyin only copies count bytes; as a result, a PTRACESETREGSET request with a short iovlen causes the remaining portion of the stack buffer to remain uninitialized...

Linux kernel security vulnerabilities

Security vulnerabilities exist in Linux kernel versions prior to 6.12.113, 6.18.56, and 7.2.10. These vulnerabilities stem from improper permission checks in perfeventopen, which fails to enforce kernel analysis permissions during calls to the kernel. As a result, unprivileged users may be able t...

Linux kernel security vulnerabilities

A security vulnerability exists in the Linux kernel. It stems from the fact that the sdhcisprdremove function in drivers/mmc/host/sdhci-sprd.c fails to perform runtime PM cleanup. As a result, clocks managed by the runtime PM callback are disabled directly when the device is in a runtime suspend...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.16. It arises because amt devices’ buffers of skb objects reference the original pointers within their skb-cb fields. When these buffers are released due to a tunnel expiration, subsequent enqueuing operations trigger reuse after release i...