PT-2026-72453

In the Linux kernel, the following vulnerability has been resolved: fbdev: nvidia: fix potential memory leak in nvidiafb probe In nvidiafb probe, the memory allocated for modelist in nvidia set fbinfo is not freed in the subsequent error paths. Fix that by calling fb destroy modelist...

PT-2026-72848

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pci get drvdata type in AER handlers rtw88 stores an ieee80211 hw pointer via pci set drvdata at probe time, but io error detected and io resume retrieve it as a net device pointer. This causes netif device...

PT-2026-72360

In the Linux kernel, the following vulnerability has been resolved: mm/mm init: fix uninitialized struct pages for ZONE DEVICE If DAX memory is hotplugged into an unoccupied subsection of an early section, section activate reuses the unoptimized boot memmap. However, compound nr pages still assum...

PT-2026-73022

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfs rl realloc and ntfs rl realloc nofail...

PT-2026-72852

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix memory leak in radeon ring restore on lock failure radeon ring restore takes ownership of the data buffer allocated by radeon ring backup. The caller radeon gpu reset only frees it in the non-restore branch; in th...

PT-2026-72221

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, fix matcher leak on resize target setup failure hws bwc matcher move allocates a replacement matcher before setting it as the resize target. If mlx5hws matcher resize set target fails, the replacement matcher is no...

PT-2026-73062

Name of the Vulnerable Software and Affected Versions Pandora affected versions not specified Description Pandora contains a denial-of-service issue in its handling of DAA Direct Access Archive files. During the extraction of an internal ISO image from a DAA archive, the system uses the...

PT-2026-72627

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writes pending leak on write request failures raid10 make request acquires a writes pending reference with md write start before dispatching write requests. Several failure paths in raid10 write request complete th...

PT-2026-72601

In the Linux kernel, the following vulnerability has been resolved: sctp: fix err chunk memory leaks in INIT handling When sctp verify init encounters unrecognized parameters, it allocates an err chunk to report them. However, this chunk is leaked in several code paths: 1. In sctp sf do 5 1B init...

PT-2026-73002

In the Linux kernel, the following vulnerability has been resolved: net: do not send ICMP/NDISC Redirects when peer allocation fails When inet getpeer v4 or inet getpeer v6 fails to allocate a peer entry under memory pressure or tree size caps, redirect handlers previously fell back to sending...

PT-2026-72980

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: hold conn in hci past sync callback Avoids giving freed pointers to hci conn valid, which kmalloc may have reused. Hold refcount to avoid that...

PT-2026-72532

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable mlx5 lag get dev seq will return error when the peer isn't in the LAG or when no device is marked as master. Result bad memory access and kernel crash1. Hence, ski...

PT-2026-72182

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

PT-2026-72411

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Free arena sub-allocations on discover arenas error path Memory allocated by btt freelist init, btt rtt init, and btt maplocks init is not freed on some discover arenas error paths. This leaks memory when arena...

PT-2026-72357

In the Linux kernel, the following vulnerability has been resolved: kho: make sure scratch size is always aligned by CMA MIN ALIGNMENT BYTES When using scratch scale, the scratch sizes are rounded up to CMA MIN ALIGNMENT BYTES since they will be released as MIGRATE CMA. This is not done when usin...

PT-2026-72455

In the Linux kernel, the following vulnerability has been resolved: fbdev: carminefb: fix potential memory leak in alloc carmine fb The memory allocated for modelist in fb videomode to modelist is not freed in the subsequent error path. Fix that by calling fb destroy modelist...

PT-2026-72475

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks Move the off-by-default consistency check for vmcs12.tpr threshold vs. the virtual APIC vTPR into the "normal" controls checks, as waiting until KVM ha...

PT-2026-72469

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: account pKVM reclaim against the VM mm Protected guest faults charge long term pins to the VM's mm. Teardown can run later from file release, where current-mm may be unrelated. Drop the charge from kvm-mm instead...

PT-2026-72797

In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used instead of =, incorrectly accepting fdp idx when it equals n i.e. NUMFDPC + 1...

PT-2026-72698

In the Linux kernel, the following vulnerability has been resolved: kcm: use WRITE ONCE when changing lower socket callbacks kcm attach replaces a live lower TCP socket's sk data ready and sk write space callbacks with KCM handlers, and kcm unattach restores them later. Those callback-pointer...