PT-2026-72558

In the Linux kernel, the following vulnerability has been resolved: iomap: release pages on atomic dio size mismatch If bio iov iter get pages or the bounce helper succeeds but builds a short bio, the REQ ATOMIC size check rejects it before submission. The old error path only dropped the bio...

PT-2026-72372

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix hole runlist memory leak in insert range error path ntfs non resident attr insert range allocates hole rl before mapping the whole runlist. If ntfs attr map whole runlist fails, the error path drops ni-runlist.lock and...

PT-2026-72523

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hci add adv monitor publishes a new adv monitor in hdev-adv monitors idr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...

PT-2026-72636

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown The send-queue timestamp ring is allocated with qmem alloc when timestamping is used, but otx2 free sq res never freed sq-timestamps, leaking that memory across ifdown and...

Linux Distros Unpatched Vulnerability : CVE-2026-74269

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bnxt: fix head underflow on XDP head-grow The xdp.py test testxdpnativeadjstheadgrowdata crashes when run on a bnxt machine and also crashes in NIPA. It seems...

PT-2026-72977

In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fails, init dma desc rings only frees the partially allocated RX rings and returns. The TX rings that were allocated earlier in the same functi...

PT-2026-72186

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufs mem mmap access spufs mem mmap access computes the local store offset as address - vma-vm start, but bounds-checks it against vma-vm end instead of the local store size. On 64-bit,...

PT-2026-72212

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1.2 Description A memory leak occurs in the octeontx2-pf driver during initialization failure. The otx2 init hw resources function initializes SQ aura and pool resources, but if a subsequent setup step fails, t...

PT-2026-72896

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAW PRIMITIVES header size before division vmw cmd draw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is u32 and is taken straight from the user-supplied command stream. When...

PT-2026-72810

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix error-path detection with md cloned bio Detect the error path using md cloned bio instead of relying on r1 bio in raid1 or r10 bio-read slot in raid10, which may be NULL or -1 after splitting and resubmitting...

PT-2026-72522

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISO END/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISO CONT, ISO END packets. We currently reject them if they are last. If controller sends malformed sequence ISO...

PT-2026-72689

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt re: Initialize dpi variable to zero dpi is initialized only for BNXT RE ALLOC WC PAGE, but copied for all the cases. So initialize the dpi to 0...

PT-2026-73028

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobj ext array from its own slab" avoided recursive allocation of obj exts from kmalloc caches of the same...

PT-2026-72574

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced A group ref is tied to the pending tiler oom work, so we need to release it if the cancel was effective...

PT-2026-72721

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netif rxq cleanup unlease tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA...

PT-2026-73012

In the Linux kernel, the following vulnerability has been resolved: xsk: fix buffer leak in xsk drop skb for AF XDP multi-buffer Tx This patch is inspired by the check1 from sashiko. It says when overflow happens, the address of cq to be published is invalid. Actually the severer thing is the who...

PT-2026-73016

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt hashlimit: validate hashtable supports XT HASHLIMIT RATE MATCH The XT HASHLIMIT RATE MATCH flag mode changes the semantics of the dsthash ent structure which represents an entry in the hashtable. There is a union ar...

PT-2026-73029

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtm tos in mpls getroute mpls getroute builds the RTM NEWROUTE reply to an RTM GETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed alloc skbNLMSG GOODSIZE, .... It...

PT-2026-73014

In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh-lock for f6i list walks in replace check and notify fib6 check nh list and nexthop replace notify walk nh-f6i list during an RTNL-serialized nexthop replace without holding nh-lock. IPv6 RTM NEWROUTE/RTM DELROUTE...

PT-2026-72248

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure t7xx cldma late init creates md ctrl-gpd dmapool before initializing the TX and RX rings. If any ring initialization fails, the error path frees the already initialized...