PT-2026-72852

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix memory leak in radeon ring restore on lock failure radeon ring restore takes ownership of the data buffer allocated by radeon ring backup. The caller radeon gpu reset only frees it in the non-restore branch; in th...

PT-2026-72601

In the Linux kernel, the following vulnerability has been resolved: sctp: fix err chunk memory leaks in INIT handling When sctp verify init encounters unrecognized parameters, it allocates an err chunk to report them. However, this chunk is leaked in several code paths: 1. In sctp sf do 5 1B init...

PT-2026-72532

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable mlx5 lag get dev seq will return error when the peer isn't in the LAG or when no device is marked as master. Result bad memory access and kernel crash1. Hence, ski...

PT-2026-72182

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

PT-2026-72365

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: fix dir put orders in access pattern add dirs Patch series "mm/damon/sysfs-schemes: fix wrong directories put orders in error paths". Error paths of damon sysfs access pattern add dirs and damon sysfs sche...

PT-2026-72334

In the Linux kernel, the following vulnerability has been resolved: dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Once the interrupt is requested, the interrupt handler may run immediately. Since the IRQ handler can access channel-ch base, which is initialized only aft...

PT-2026-72461

In the Linux kernel, the following vulnerability has been resolved: fbdev: efifb: fix memory leak in efifb probe Since commit 73ce73c30ba9 "fbdev: Transfer video= option strings to caller; clarify ownership" the string returned from fb get options is expected to be freed by the caller, but the...

PT-2026-72458

In the Linux kernel, the following vulnerability has been resolved: fbdev: s3fb: fix potential memory leak in s3 pci probe In s3 pci probe, the memory allocated for modelist using fb videomode to modelist is not freed in subsequent error paths. Fix that by calling fb destroy modelist...

PT-2026-72833

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5 ib alloc transport domain allocates a transport domain and then may fail in mlx5 ib enable lb. In that case, the allocated TD is leaked. Fix this by...

PT-2026-72392

In the Linux kernel, the following vulnerability has been resolved: ntfs: centalize $INDEX ROOT header validation Add a dedicated helper to perform stricter validation of $INDEX ROOT and use it for both directory inodes and named index inodes. This keeps the root size and header geometry checks...

PT-2026-72840

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix snp filter reserved mem regions off-by-one Sashiko notes: regarding the bounds check in snp filter reserved mem regions called via walk iomem res desc: does the check if range list-num elements 16 + 8 PAGE SIZE...

PT-2026-72817

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1x bo pin with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference t...

PT-2026-72615

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix effective prog array index with BPF F PREORDER replace effective prog and purge effective progs located the slot in the effective array by walking the program hlist and counting entries linearly. That count does not matc...

PT-2026-72751

In the Linux kernel, the following vulnerability has been resolved: lockd: Avoid hashing uninitialized bytes in nlm4svc lookup file file hash digests the first LOCKD FH HASH SIZE bytes of nfs fh.data when bucketing nlm files, independent of fh.size. Commit 3de744ee4e45 "lockd: Use xdrgen XDR...

PT-2026-72328

In the Linux kernel, the following vulnerability has been resolved: i2c: mlxbf: Fix use-after-free in mlxbf i2c init resource If devm platform get and ioremap resource returns an error, mlxbf i2c init resource frees tmp res before reading tmp res-io to get the error code. This results in a...

PT-2026-72432

In the Linux kernel, the following vulnerability has been resolved: gpu/buddy: bail out of try harder when alignment cannot be honoured The try harder contiguous fallback could return a range whose start offset did not match the caller's min block size. When a candidate's start is misaligned,...

PT-2026-72404

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: Fix leak when custom dump segments addition fails Free allocated minidump region 'name' in qcom add minidump segments when failing before adding the region to 'dump segments'. Otherwise, the 'name' is not tracke...

PT-2026-72221

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, fix matcher leak on resize target setup failure hws bwc matcher move allocates a replacement matcher before setting it as the resize target. If mlx5hws matcher resize set target fails, the replacement matcher is no...

PT-2026-72209

In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ip vs seq structs in ip vs conn new Commit 9a05475cebdd "ipvs: avoid kmem cache zalloc in ip vs conn new" changed ip vs conn new to allocate an ip vs conn object with kmem cache alloc. The function then initializ...

PT-2026-72380

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound to move in indx insert into root before hdr insert head indx insert into root promotes a full resident $INDEX ROOT into $INDEX ALLOCATION and copies all non-last resident root entries into a newly allocated INDEX...