PT-2026-72892

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xe exec ioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs,...

PT-2026-72971

In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: don't free uninitialized dev name on error path dt remember or free map duplicates dev name for each map entry. If kstrdup const fails, dt free map frees dev name in all num maps entries, including entries th...

PT-2026-72988

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release iso sock kill tests !sock flagsk, SOCK ZAPPED || sk-sk socket || sock flagsk, SOCK DEAD for early return, but this is always true since sock orphansk sets SOCK DEAD, so the sk...

PT-2026-73003

In the Linux kernel, the following vulnerability has been resolved: hwmon: nzxt-smart2 DMA-align output buffer Sashiko reports: When send output report calls hid hw output report, the underlying USB HID core calls usb interrupt msg which maps this buffer directly for DMA. When the DMA mapping...

PT-2026-72406

In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm file refcount leak on cached nlm do fopen failure The cached-file path in nlm lookup file reaches the found: label unconditionally, even when nlm do fopen fails. At that label result and file-f count are updated...

Linux Distros Unpatched Vulnerability : CVE-2026-72321

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: igmp: Fix potential memory leaks in igmpmodtimer and igmpstoptimer When a timer is deleted and not re-armed in igmpmodtimer, or stopped in igmpstoptimer,...

Linux Distros Unpatched Vulnerability : CVE-2026-72494

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/irdma: Replace waitqueue and flag with completion The driver previously used a waitqueue along with an explicit requestdone flag, but without proper barrie...

Linux Distros Unpatched Vulnerability : CVE-2026-74386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet-tcp: fix page fragment cache leak in error path In nvmettcpallocqueue, when a connection is closed during the allocation process e.g., nvmettcpsetqueuesoc...

Linux Distros Unpatched Vulnerability : CVE-2026-74443

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/vmwgfx: bound DMA command body size against suffix pointer vmwcmddma locates the DMA suffix at unsigned long &cmd-body + header-size - sizeofsuffix without...

PT-2026-72333

In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/tpmi: use cleanup helpers in mem write In mem write, the temporary array returned by parse int array user must be released on all exit paths. Convert the array variable to use cleanup.h scope-based cleanup so i...

PT-2026-72788

In the Linux kernel, the following vulnerability has been resolved: of: reserved mem: avoid post-init UAF when alloc reserved mem array fails The global pointer 'reserved mem' continues to reference the reserved mem array which lives in initdata if alloc reserved mem array fails. of reserved mem...

PT-2026-72839

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Check for page allocation failure correctly in TIO Sashiko notes: if snp alloc firmware pages returns NULL under memory pressure, is it safe to pass it directly to page address? On architectures without HASHED PAGE...

PT-2026-72190

In the Linux kernel, the following vulnerability has been resolved: memstick: ms block: reject a card that reports too many blocks msb ftl initialize computes the zone count from the card block count with no bound: msb-zone count = msb-block count / MS BLOCKS IN ZONE; ... for i = 0; i zone count;...

PT-2026-72215

In the Linux kernel, the following vulnerability has been resolved: irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure imsic early acpi init allocates a firmware node before setting up the IMSIC state. If imsic setup state fails, the function returns without freeing the allocat...

PT-2026-72661

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decouple req recycling from RPC completion rl kref formerly served two distinct lifetimes through a single refcount: it gated when a Reply could wake its RPC task, and it gated when an rpcrdma req could return to its fr...

PT-2026-72462

In the Linux kernel, the following vulnerability has been resolved: fbdev: hecubafb: fix potential memory leak in hecubafb probe The memory allocated for pagerefs in fb deferred io init is not freed on the error path. Fix it by calling fb deferred io cleanup...

PT-2026-72452

In the Linux kernel, the following vulnerability has been resolved: fbdev: tridentfb: fix potential memory leak in trident pci probe In trident pci probe, the memory allocated for modelist using fb videomode to modelist is not freed in subsequent error paths. Fix that by calling fb destroy modeli...

PT-2026-72509

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential memory leaks in igmp mod timer and igmp stop timer When a timer is deleted and not re-armed in igmp mod timer, or stopped in igmp stop timer, the code currently decrements the reference counter of the...

PT-2026-72566

In the Linux kernel, the following vulnerability has been resolved: afs: Fix error code in afs extract vl addrs The error codes on these paths are only set on the first iteration through the loop. Set the correct error code on every iteration...

PT-2026-72527

In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on build skb failure qede rx build skb and qede tpa rx build skb do not check for a NULL return from qede build skb. When it returns NULL under memory pressure, the functions still...