PT-2026-72396

In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfs ea lookup and ntfs listxattr, this verifies that there is enough space in the EA entry before accessing the next entry offset field of the EA entry...

PT-2026-72392

In the Linux kernel, the following vulnerability has been resolved: ntfs: centalize $INDEX ROOT header validation Add a dedicated helper to perform stricter validation of $INDEX ROOT and use it for both directory inodes and named index inodes. This keeps the root size and header geometry checks...

PT-2026-72377

In the Linux kernel, the following vulnerability has been resolved: ntfs: fail attrlist updates when the superblock is inactive generic shutdown super clears SB ACTIVE before evicting cached inodes. If eviction selects the fake inode for a base inode's unnamed $ATTRIBUTE LIST attribute, ntfs evic...

PT-2026-72373

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix WARN ON for resident attribute in ntfs map runlist nolock When ntfs map runlist nolock needs to look up the attribute extent containing a target VCN ctx needs reset == true, it calls ntfs attr lookup and then expects th...

PT-2026-72455

In the Linux kernel, the following vulnerability has been resolved: fbdev: carminefb: fix potential memory leak in alloc carmine fb The memory allocated for modelist in fb videomode to modelist is not freed in the subsequent error path. Fix that by calling fb destroy modelist...

PT-2026-72453

In the Linux kernel, the following vulnerability has been resolved: fbdev: nvidia: fix potential memory leak in nvidiafb probe In nvidiafb probe, the memory allocated for modelist in nvidia set fbinfo is not freed in the subsequent error paths. Fix that by calling fb destroy modelist...

PT-2026-72319

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTH RECEIVE buffers nvmet execute auth receive trusts the AUTH RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default state...

PT-2026-72594

In the Linux kernel, the following vulnerability has been resolved: net: sungem: fix probe error cleanup gem init one calls gem remove one when register netdev fails. gem remove one unregisters and frees resources owned by the net device, including the DMA block, MMIO mapping, PCI regions, and th...

PT-2026-72628

In the Linux kernel, the following vulnerability has been resolved: md/raid1: fix writes pending and barrier reference leaks on write failures raid1 make request acquires a writes pending reference with md write start before calling raid1 write request. Several failure paths in raid1 write reques...

PT-2026-72623

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix order of kfree rcu and rcu assign pointer Sashiko pointed out that kfree rcu was called before rcu assign pointer in handling the comment extension. Fix the order so that rcu assign pointer called first...

PT-2026-72309

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu list annotations and operations sashiko-bot remarked the missing use of list add rcu in bcm rx|tx setup to have a proper initialized bcm op structure when bcm proc show traverses the bcm op's under rcu...

PT-2026-72285

In the Linux kernel, the following vulnerability has been resolved: dm-verity: make error counter atomic The error counter "v-corrupted errs" was not atomic, thus it could be subject to race conditions. The call to dm audit log target"max-corrupted-errors" may be skipped due to the races...

PT-2026-72331

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Restore SST-PP control to all domains The SST-PP control offset is only restored to power domain 0 after resume. During suspend, control values are read and stored for all power domains. Use pd info-sst base...

PT-2026-72328

In the Linux kernel, the following vulnerability has been resolved: i2c: mlxbf: Fix use-after-free in mlxbf i2c init resource If devm platform get and ioremap resource returns an error, mlxbf i2c init resource frees tmp res before reading tmp res-io to get the error code. This results in a...

PT-2026-72404

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: Fix leak when custom dump segments addition fails Free allocated minidump region 'name' in qcom add minidump segments when failing before adding the region to 'dump segments'. Otherwise, the 'name' is not tracke...

PT-2026-72484

In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETH HLEN to be pullable in ife decode ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes the decapsulated packet to eth type trans, which expects the inner...

PT-2026-72402

In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-battery: Fix missing nvmem device put causing reference leak In cpcap battery detect battery type, the reference to an nvmem device obtained via nvmem device find is not released with nvmem device put on the...

PT-2026-72463

In the Linux kernel, the following vulnerability has been resolved: fbdev: broadsheetfb: fix potential memory leak in broadsheetfb probe The memory allocated for pagerefs in fb deferred io init is not freed on the error path. Fix it by calling fb deferred io cleanup...

PT-2026-72486

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtr endpoint post qrtr endpoint post validates an incoming packet with if !size || len != ALIGNsize, 4 + hdrlen goto err; where size comes from the wire. On 32-bit, size t is 32 bits and...

PT-2026-72416

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: fix primary if leak on failed linearization If the skb has a frag list, it must be linearized before it can be split using skb split. But when this step failed, it must not only free the skb but also take care o...