PT-2026-72328

In the Linux kernel, the following vulnerability has been resolved: i2c: mlxbf: Fix use-after-free in mlxbf i2c init resource If devm platform get and ioremap resource returns an error, mlxbf i2c init resource frees tmp res before reading tmp res-io to get the error code. This results in a...

PT-2026-72402

In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-battery: Fix missing nvmem device put causing reference leak In cpcap battery detect battery type, the reference to an nvmem device obtained via nvmem device find is not released with nvmem device put on the...

PT-2026-72463

In the Linux kernel, the following vulnerability has been resolved: fbdev: broadsheetfb: fix potential memory leak in broadsheetfb probe The memory allocated for pagerefs in fb deferred io init is not freed on the error path. Fix it by calling fb deferred io cleanup...

PT-2026-72329

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 IRQ SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next...

PT-2026-72314

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix use-after-free race with concurrent NETDEV UNREGISTER isotp release looked up the bound network device via dev get by index using the stored ifindex. During device unregistration the device is unlisted from the...

PT-2026-72316

In the Linux kernel, the following vulnerability has been resolved: netdev-genl: report NAPI thread PID in the caller's pid namespace netdev nl napi fill one reports the NAPI kthread PID in NETDEV A NAPI PID using task pid nr, which returns the PID in the initial pid namespace. NETDEV CMD NAPI GE...

PT-2026-72427

In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSR AMD64 SYSCFG SNP EN" Revert 99cf1fb58e68 "x86/virt/sev: Drop WBINVD before setting MSR AMD64 SYSCFG SNP EN". Section 8.8 of the SNP spec says: Before invoking SNP INIT EX with...

PT-2026-72428

In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix reference leak on failed device registration When platform device register fails in sm501 register device, the embedded struct device in pdev has already been initialized by device initialize, but the failure path...

PT-2026-72425

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/brs: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERF SAMPLE BRANCH USER is requested. On...

PT-2026-72302

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing device refcount for CAN filter removal sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6...

PT-2026-72307

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN detected a data race within the bcm rx handler when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. Use atomic operations with...

PT-2026-72553

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix writethrough to use collection offload Fix writethrough write to set NETFS RREQ OFFLOAD COLLECTION on the request so that collection is processed asynchronously rather than only right at the end - and also so that...

PT-2026-72607

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf nat: avoid invalid nat net pointer use on failed nf nat init We ran into below KASAN splat, which is mostly uninteresting, beside for having nf nat register fn in the call chain as a cause for the offending access:...

PT-2026-72622

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, cancel delayed work sync was called while gc calls queue delayed work unconditionally which can lead not to properly shutting down the...

PT-2026-72575

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix potential invalid pointer deref in group process tiler oom If heaps is an ERR PTR, panthor heap pool put will deref an invalid pointer. Make sure we set it to NULL in that case...

PT-2026-72365

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: fix dir put orders in access pattern add dirs Patch series "mm/damon/sysfs-schemes: fix wrong directories put orders in error paths". Error paths of damon sysfs access pattern add dirs and damon sysfs sche...

PT-2026-72350

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2 sum rightmost rec BUG On-disk corruption setting l next free rec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. CAUSE ocfs2 sum...

PT-2026-72245

In the Linux kernel, the following vulnerability has been resolved: net: ena: clean up XDP TX queues when regular TX setup fails create queues with size backoff creates XDP TX queues before setting up the regular TX path. If the subsequent allocation or creation of regular TX queues fails, the...

PT-2026-72357

In the Linux kernel, the following vulnerability has been resolved: kho: make sure scratch size is always aligned by CMA MIN ALIGNMENT BYTES When using scratch scale, the scratch sizes are rounded up to CMA MIN ALIGNMENT BYTES since they will be released as MIGRATE CMA. This is not done when usin...

PT-2026-72996

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls u32: validate offshift to prevent shift-out-of-bounds u32 change copies the user-provided tc u32 sel.offshift unsigned char, 0-255 into the kernel knode object without bounds validation. When a packet later hits u3...