PT-2026-72300

In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register bounds before narrowing retval range in check mem access When the BPF verifier processes a context load of an LSM hook return value, it calls mark reg s32 range to narrow the register to the hook's valid range...

PT-2026-72635

In the Linux kernel, the following vulnerability has been resolved: sctp: hold socket lock when dumping endpoints in sctp diag SCTP DIAG endpoint dumping was traversing endpoint address lists without holding lock sock, while those lists could change concurrently via socket operations e.g., bindx...

PT-2026-72290

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix leaking uninitialized kernel memory If hash size is less than device's tuple size, dm-integrity is supposed to zero the remaining space. There was a bug in the code that zeroing didn't work. This commit fixes it...

PT-2026-72275

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsiback device action obtains a command tag in scsiback get pend req and submits a task-management request with target submit tmr. When target submit tmr...

PT-2026-72764

In the Linux kernel, the following vulnerability has been resolved: iommufd: Destroy the pages content after detaching from dmabuf Sashiko points out this has gotten out of order, the mutex could still be in use through the dmabuf invalidation callbacks. Don't destroy any of the pages content unt...

PT-2026-72272

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core scsi3 emulate pro register and move maps the PERSISTENT RESERVE OUT parameter list with transport kmap data sg and parses the destination TransportID wit...

PT-2026-72227

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: fix BAR resource leak on PF number failure If cn23xx get pf num fails, the function returns without unmapping either BAR. Unmap both BARs before returning from the error path. Found by manual code review...

PT-2026-72359

In the Linux kernel, the following vulnerability has been resolved: mtd: slram: remove failed entries from the device list register device links a new slram mtdlist entry before allocating all of the state needed by the entry. If a later allocation, memremap, or mtd device register fails, the...

PT-2026-72270

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix I/O leak on unsupported additional CDB efct dispatch fcp cmd allocates an efct io before dispatching an unsolicited FCP command. If the command has an unsupported additional CDB, the function returns -EIO...

PT-2026-72589

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insn aux data leak on verifier err free env path When bpf check allocates env-insn aux data successfully but later fails to allocate env-succ, it jumps directly to err free env. The existing vfreeenv-insn aux data sits...

PT-2026-72669

In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: ak8975: fix potential kernel stack memory leak Currently in the AK8975 driver there are four instances where potential uninitialized kernel stack memory leaks can occur. If i2c smbus read i2c block data or...

PT-2026-72558

In the Linux kernel, the following vulnerability has been resolved: iomap: release pages on atomic dio size mismatch If bio iov iter get pages or the bounce helper succeeds but builds a short bio, the REQ ATOMIC size check rejects it before submission. The old error path only dropped the bio...

PT-2026-72372

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix hole runlist memory leak in insert range error path ntfs non resident attr insert range allocates hole rl before mapping the whole runlist. If ntfs attr map whole runlist fails, the error path drops ni-runlist.lock and...

PT-2026-72523

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hci add adv monitor publishes a new adv monitor in hdev-adv monitors idr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...

PT-2026-72977

In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fails, init dma desc rings only frees the partially allocated RX rings and returns. The TX rings that were allocated earlier in the same functi...

PT-2026-72186

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufs mem mmap access spufs mem mmap access computes the local store offset as address - vma-vm start, but bounds-checks it against vma-vm end instead of the local store size. On 64-bit,...

PT-2026-72212

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1.2 Description A memory leak occurs in the octeontx2-pf driver during initialization failure. The otx2 init hw resources function initializes SQ aura and pool resources, but if a subsequent setup step fails, t...

PT-2026-72896

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAW PRIMITIVES header size before division vmw cmd draw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is u32 and is taken straight from the user-supplied command stream. When...

PT-2026-72810

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix error-path detection with md cloned bio Detect the error path using md cloned bio instead of relying on r1 bio in raid1 or r10 bio-read slot in raid10, which may be NULL or -1 after splitting and resubmitting...

PT-2026-72522

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISO END/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISO CONT, ISO END packets. We currently reject them if they are last. If controller sends malformed sequence ISO...