PT-2026-73016

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt hashlimit: validate hashtable supports XT HASHLIMIT RATE MATCH The XT HASHLIMIT RATE MATCH flag mode changes the semantics of the dsthash ent structure which represents an entry in the hashtable. There is a union ar...

PT-2026-73029

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtm tos in mpls getroute mpls getroute builds the RTM NEWROUTE reply to an RTM GETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed alloc skbNLMSG GOODSIZE, .... It...

PT-2026-72195

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: free mlx5 st idx data on final dealloc Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints e.g. churning RDMA MRs leak one struct mlx5 st idx data per cycle; kmemleak flags it as...

PT-2026-72183

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211 mle common size uses the first common-info octet as the common information length for all known MLE types. However, ieee80211 mle size ok only validates that octet for...

PT-2026-73019

In the Linux kernel, the following vulnerability has been resolved: keys: fix out-of-bounds read in keyring get key chunk For description-level chunks keyring get key chunk advances the read pointer by level sizeoflong past the inline prefix but only bounds-checks the prefix, so a long enough key...

PT-2026-72589

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insn aux data leak on verifier err free env path When bpf check allocates env-insn aux data successfully but later fails to allocate env-succ, it jumps directly to err free env. The existing vfreeenv-insn aux data sits...

PT-2026-73014

In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh-lock for f6i list walks in replace check and notify fib6 check nh list and nexthop replace notify walk nh-f6i list during an RTNL-serialized nexthop replace without holding nh-lock. IPv6 RTM NEWROUTE/RTM DELROUTE...

PT-2026-72248

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure t7xx cldma late init creates md ctrl-gpd dmapool before initializing the TX and RX rings. If any ring initialization fails, the error path frees the already initialized...

PT-2026-72570

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parse dacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

PT-2026-72737

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix URB leak in alloc mtk intr urb error path When btmtk isopkt pad fails, the previously allocated URB is not freed, leaking the urb structure. Add usb free urb before returning the error...

PT-2026-72321

In the Linux kernel, the following vulnerability has been resolved: NFS: Charge unstable writes by request size, not folio size nfs folio mark unstable and nfs folio clear commit charge and uncharge NR WRITEBACK/WB WRITEBACK by folio nr pagesfolio once per request added to or removed from a commi...

PT-2026-72465

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the...

PT-2026-72401

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch In alloc hugetlb folio, a single h cg pointer is used for both the rsvd and non-rsvd hugetlb cgroup charges. When map chg is set, hugetlb cgroup charge cgroup rsvd stor...

PT-2026-72565

In the Linux kernel, the following vulnerability has been resolved: afs: Remove setting of AS RELEASE ALWAYS for symlinks and mountpoints Regular AFS files correctly use afs file aops which have release folio set as netfs release folio, so AS RELEASE ALWAYS is valid for them when fscache is enabl...

PT-2026-72400

In the Linux kernel, the following vulnerability has been resolved: mm/memory hotplug: fix incorrect altmap passing in error path In create altmaps and memory blocks, when arch add memory succeeds with memmap on memory enabled, the vmemmap pages are allocated from params.altmap. If create memory...

PT-2026-72296

In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but era map calculates the writeset block before applying the target offset. Tables with a non-zero start sector ca...

PT-2026-72816

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommu map sgtable return value check Commit "iommu: return full error code from iommu map sg atomic" changed iommu map sgtable to return an ssize t and negative values in error cases, rather than a size t and a...

PT-2026-72393

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the NTFS driver during mount failures. When the ntfs fill super function fails, the err out now path only frees the volume structure, failing to release other...

PT-2026-72870

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpc recvmsg oob takes a received oob message off recvmsg oobq and, if a response is needed, moves it onto the pending oobq tree. However, only the unlink from recvms...

PT-2026-72448

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Check runtime resume during probe The MT8192 AFE probe enables runtime PM temporarily while reinitializing the regmap cache from hardware, but it uses pm runtime get sync without checking the return value...