PT-2026-72352

In the Linux kernel, the following vulnerability has been resolved: ocfs2: avoid moving extents to occupied clusters For non-auto OCFS2 IOC MOVE EXT operations, userspace supplies a physical me goal. ocfs2 move extent initializes new phys cpos from that goal and expects ocfs2 probe alloc group to...

PT-2026-72236

In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210 test int driver write and ca8210 test int user read exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as the byte count to kfif...

PT-2026-72365

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: fix dir put orders in access pattern add dirs Patch series "mm/damon/sysfs-schemes: fix wrong directories put orders in error paths". Error paths of damon sysfs access pattern add dirs and damon sysfs sche...

PT-2026-72519

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix VMA access race aie2 populate range and amdxdna umap release access a saved VMA pointer that may have already been freed, leading to a potential use-after-free. Remove the VMA accesses from these functions to...

PT-2026-72769

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-legacy: Bound DAI link iteration create sdw dailinks walks soc dais until it finds an entry with initialised cleared, but soc dais is allocated with exactly num ends entries. If all entries are initialised, the...

PT-2026-72427

In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSR AMD64 SYSCFG SNP EN" Revert 99cf1fb58e68 "x86/virt/sev: Drop WBINVD before setting MSR AMD64 SYSCFG SNP EN". Section 8.8 of the SNP spec says: Before invoking SNP INIT EX with...

PT-2026-72439

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf nat sip: reload possible stale data pointer quoting sashiko: ------------------------------------------------------------------------ .. noticed a potential memory bug and header corruption involving the SIP NAT...

PT-2026-72383

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attr off in UpdateResidentValue against data off In do action's UpdateResidentValue case fslog.c:3307, lrh-attr off and lrh-redo len come from the on-disk LRH. When they satisfy aoff + dlen res.data off, the...

PT-2026-72486

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtr endpoint post qrtr endpoint post validates an incoming packet with if !size || len != ALIGNsize, 4 + hdrlen goto err; where size comes from the wire. On 32-bit, size t is 32 bits and...

PT-2026-72625

In the Linux kernel, the following vulnerability has been resolved: md/raid1: free r1 bio when REQ NOWAIT is set and read would block on retry When a read is retried, raid1 read request may be called with a pre-allocated r1 bio. If wait read barrier fails for a REQ NOWAIT read, the bio is complet...

PT-2026-72455

In the Linux kernel, the following vulnerability has been resolved: fbdev: carminefb: fix potential memory leak in alloc carmine fb The memory allocated for modelist in fb videomode to modelist is not freed in the subsequent error path. Fix that by calling fb destroy modelist...

PT-2026-72610

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn-preauth info in concurrent SMB2 NEGOTIATE conn-preauth info is shared connection state struct preauth integrity info, kmalloc-96 that is allocated and freed by the SMB2 NEGOTIATE handler and read...

PT-2026-72833

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5 ib alloc transport domain allocates a transport domain and then may fail in mlx5 ib enable lb. In that case, the allocated TD is leaked. Fix this by...

PT-2026-73006

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bounds clear bit in ath12k mac dp peer cleanup ath12k mac dp peer cleanup clears the ML peer ID slot on the free ml peer id map bitmap by indexing it with dp peer-peer id. That is wrong: dp peer-peer id f...

PT-2026-72520

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Prevent PM resume deadlock in hwctx sync debug bo amdxdna hwctx sync debug bo invokes the hardware hwctx sync debug bo callback while holding xdna-dev lock. The callback may call amdxdna cmd submit, which in turn...

PT-2026-72862

In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afs get tree afs alloc sbi uses kzalloc for memory allocation. And, if ctx-dyn root is not null, as-cell and as-volume are null. In trace afs get tree they are dereferenced. KASAN error messag...

PT-2026-72594

In the Linux kernel, the following vulnerability has been resolved: net: sungem: fix probe error cleanup gem init one calls gem remove one when register netdev fails. gem remove one unregisters and frees resources owned by the net device, including the DMA block, MMIO mapping, PCI regions, and th...

PT-2026-72652

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdma wc receive decrements the transport's Receive count for every completion before it dispatches a successful Receive to rpcrdma reply handler. The handler must post a...

PT-2026-72784

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: require a ref for locking state debugfs open debug lockres open copies inode-i private into struct debug lockres and debug lockres release later drops that pointer with dlm put. That only works if open successfully pin...

PT-2026-72945

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket use-after-free during link group termination smc lgr terminate drops conns lock after finding a connection in lgr-conns all, but before taking a reference on its socket. The connection is embedded in the socke...