CVE-2026-97415: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate names in ROOTREF and ROOTBACKREF ROOTREF and ROOTBACKREF items contain a struct btrfsrootref followed by the subvolume name. Several readers assume that this layout is already valid and then use the...

PT-2026-98049

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the btrfs tree-checker where ROOT REF and ROOT BACKREF items, which consist of a btrfs root ref structure followed by a subvolume name, are not properly validated. Som...

PT-2026-98058

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu/ras component where cp ecc error irq is acquired in amdgpu gfx ras late init but released in gfx v9 0 hw fini. This mismatch requires the release site t...

PT-2026-98138

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer dereference exists during the devcoredump cleanup process. In the xe devcoredump snapshot free function, the ss-gt variable may be NULL if the snapshot was not fully...

PT-2026-98099

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the serial8250 register 8250 port function where uart-port.dev is conditionally copied from up-port.dev only if the latter is non-NULL. If both the existing uart slot...

PT-2026-98113

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the fw pri buf PSP private buffer was handled using open-coded memset and memcpy operations without proper validation. The fix involves...

PT-2026-98123

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free and resource leak risk exists in the lenovo se10 wdt watchdog driver. The issue occurs when the se10 pdev variable is not properly nullified, potentially allowing the...

CVE-2026-93813

In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate INODEREF's namelen BUG A crafted btrfs image can trigger the following crash: BUG: unable to handle page fault for address: ffffd1dc42884000 PF: supervisor write access in kernel mode PF:...

PT-2026-98042

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth L2CAP implementation where the l2cap recv frame function reads the two-byte Protocol Service Multiplexer PSM at the start of the payload unconditionally...

CVE-2026-93213: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: of: fix out-of-bounds read in ofaliasscan stem parser The stem parser tests isdigitend - 1 before checking end start and so reads one byte before the property name when the name is empty or all digits. Check the bound first...

CVE-2026-93782

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: flush backend after device ioctls vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOSTSETMEMTABLE can replac...

PT-2026-98048

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL-pointer dereference can occur in the ASOC mediatek mt8365-afe-pcm component. The function mt8365 afe suspend uses devm kcalloc to allocate a register backup buffer but fails to...

PT-2026-98041

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the ASOC rockchip rockchip pdm component, the rockchip pdm set fmt function calls pm runtime get sync before accessing hardware registers but fails to check the return value. If the...

CVE-2026-93802

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: validate beacon length before fixed buffer copy rsipreparebeacon copies the mac80211 beacon frame after FRAMEDESCSZ into a management skb whose usable tailroom may be smaller than MAXMGMTPKTSIZE after alignment. Valida...

CVE-2026-97509: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep XDomain reference during the lifetime of a service This is needed because we release the service ID in tbservicerelease and the ID array is owned by the parent XDomain...

CVE-2026-93814

In the Linux kernel, the following vulnerability has been resolved: spi: core: Abort active target transfer on controller suspend When an SPI controller operating in target mode has a transfer in progress at the time of system suspend, the suspend path proceeds without aborting the ongoing...

CVE-2026-93813: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate INODEREF's namelen BUG A crafted btrfs image can trigger the following crash: BUG: unable to handle page fault for address: ffffd1dc42884000 PF: supervisor write access in kernel mode PF:...

PT-2026-98076

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where hardware may provide packets with a length exceeding the maximum native Wi-Fi header length. This can lead to the ath11k dp rx h undecap nwifi function accessing an...

PT-2026-98043

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvme-fc module where a controller in the CONNECTING state may experience an admin request timeout, triggering ctrl-ioerr work to abort inflight requests. This...

CVE-2026-93225

In the Linux kernel, the following vulnerability has been resolved: phy: fsl-imx8mq-usb: fix typec switch leak on probe error path If probe fails after imx95usbphygettca succeeds, the typec switch leaks because the only cleanup path was in .remove, which never runs on probe failure. Use...