PT-2026-72272

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core scsi3 emulate pro register and move maps the PERSISTENT RESERVE OUT parameter list with transport kmap data sg and parses the destination TransportID wit...

PT-2026-72291

In the Linux kernel, the following vulnerability has been resolved: dm early create: fix freeing used table on dm resume failure If dm resume fails, the kernel attempts to free table with dm table destroy, but the table was already instantiated with dm swap table. This commit skips the call to dm...

PT-2026-72960

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transaction header hidp recv ctrl frame and hidp recv intr frame read skb-data0 before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty...

PT-2026-72703

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch codel: Do not call qdisc tree reduce backlog during peek before restoring qlen Whenever codel drops packets during peek, it calls qdisc tree reduce backlog. An issue arises because it calls qdisc tree reduce backlo...

PT-2026-73028

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobj ext array from its own slab" avoided recursive allocation of obj exts from kmalloc caches of the same...

PT-2026-72290

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix leaking uninitialized kernel memory If hash size is less than device's tuple size, dm-integrity is supposed to zero the remaining space. There was a bug in the code that zeroing didn't work. This commit fixes it...

PT-2026-72270

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix I/O leak on unsupported additional CDB efct dispatch fcp cmd allocates an efct io before dispatching an unsolicited FCP command. If the command has an unsupported additional CDB, the function returns -EIO...

PT-2026-72186

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufs mem mmap access spufs mem mmap access computes the local store offset as address - vma-vm start, but bounds-checks it against vma-vm end instead of the local store size. On 64-bit,...

PT-2026-72446

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8183: Release reserved memory on cleanup The MT8183 AFE probe can assign reserved memory with of reserved mem device init, but the assignment is never released on driver removal or later probe failures. Register...

PT-2026-72393

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the NTFS driver during mount failures. When the ntfs fill super function fails, the err out now path only frees the volume structure, failing to release other...

PT-2026-72556

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double unlock in nomem d alloc error path When start creating fails and returns -ENOMEM, it has already released the parent directory lock in start dirop: static struct dentry start dirop... ... inode lock...

PT-2026-72669

In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: ak8975: fix potential kernel stack memory leak Currently in the AK8975 driver there are four instances where potential uninitialized kernel stack memory leaks can occur. If i2c smbus read i2c block data or...

PT-2026-73014

In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh-lock for f6i list walks in replace check and notify fib6 check nh list and nexthop replace notify walk nh-f6i list during an RTNL-serialized nexthop replace without holding nh-lock. IPv6 RTM NEWROUTE/RTM DELROUTE...

PT-2026-72565

In the Linux kernel, the following vulnerability has been resolved: afs: Remove setting of AS RELEASE ALWAYS for symlinks and mountpoints Regular AFS files correctly use afs file aops which have release folio set as netfs release folio, so AS RELEASE ALWAYS is valid for them when fscache is enabl...

PT-2026-72770

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Fix locking when accessing mr-pd Sashiko points out that, due to rereg mr, the PD is actually variable and all the touches in nldev are racy. Use mr-device instead of mr-pd-device. Getting the PD restrack ID is more...

PT-2026-72624

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use test bit in lockless RCU readers in hash types Sashiko pointed out that there are a few lockless RCU readers using test bit which is a relaxed atomic operation and provides no memory barrier guarantees...

PT-2026-72211

In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llc ui autobind llc ui autobind opens a SAP after choosing a dynamic LSAP. llc sap open returns a reference owned by the caller, and llc sap add socket takes a second reference for the socket's...

PT-2026-72896

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAW PRIMITIVES header size before division vmw cmd draw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is u32 and is taken straight from the user-supplied command stream. When...

PT-2026-73029

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtm tos in mpls getroute mpls getroute builds the RTM NEWROUTE reply to an RTM GETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed alloc skbNLMSG GOODSIZE, .... It...

PT-2026-73019

In the Linux kernel, the following vulnerability has been resolved: keys: fix out-of-bounds read in keyring get key chunk For description-level chunks keyring get key chunk advances the read pointer by level sizeoflong past the inline prefix but only bounds-checks the prefix, so a long enough key...