PT-2026-72635

In the Linux kernel, the following vulnerability has been resolved: sctp: hold socket lock when dumping endpoints in sctp diag SCTP DIAG endpoint dumping was traversing endpoint address lists without holding lock sock, while those lists could change concurrently via socket operations e.g., bindx...

PT-2026-72290

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix leaking uninitialized kernel memory If hash size is less than device's tuple size, dm-integrity is supposed to zero the remaining space. There was a bug in the code that zeroing didn't work. This commit fixes it...

PT-2026-72275

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsiback device action obtains a command tag in scsiback get pend req and submits a task-management request with target submit tmr. When target submit tmr...

PT-2026-72764

In the Linux kernel, the following vulnerability has been resolved: iommufd: Destroy the pages content after detaching from dmabuf Sashiko points out this has gotten out of order, the mutex could still be in use through the dmabuf invalidation callbacks. Don't destroy any of the pages content unt...

PT-2026-72272

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core scsi3 emulate pro register and move maps the PERSISTENT RESERVE OUT parameter list with transport kmap data sg and parses the destination TransportID wit...

PT-2026-72227

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: fix BAR resource leak on PF number failure If cn23xx get pf num fails, the function returns without unmapping either BAR. Unmap both BARs before returning from the error path. Found by manual code review...

PT-2026-72359

In the Linux kernel, the following vulnerability has been resolved: mtd: slram: remove failed entries from the device list register device links a new slram mtdlist entry before allocating all of the state needed by the entry. If a later allocation, memremap, or mtd device register fails, the...

PT-2026-72270

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix I/O leak on unsupported additional CDB efct dispatch fcp cmd allocates an efct io before dispatching an unsolicited FCP command. If the command has an unsupported additional CDB, the function returns -EIO...

PT-2026-72589

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insn aux data leak on verifier err free env path When bpf check allocates env-insn aux data successfully but later fails to allocate env-succ, it jumps directly to err free env. The existing vfreeenv-insn aux data sits...

PT-2026-72669

In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: ak8975: fix potential kernel stack memory leak Currently in the AK8975 driver there are four instances where potential uninitialized kernel stack memory leaks can occur. If i2c smbus read i2c block data or...

PT-2026-72558

In the Linux kernel, the following vulnerability has been resolved: iomap: release pages on atomic dio size mismatch If bio iov iter get pages or the bounce helper succeeds but builds a short bio, the REQ ATOMIC size check rejects it before submission. The old error path only dropped the bio...

PT-2026-72372

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix hole runlist memory leak in insert range error path ntfs non resident attr insert range allocates hole rl before mapping the whole runlist. If ntfs attr map whole runlist fails, the error path drops ni-runlist.lock and...

PT-2026-72523

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hci add adv monitor publishes a new adv monitor in hdev-adv monitors idr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...

PT-2026-72636

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown The send-queue timestamp ring is allocated with qmem alloc when timestamping is used, but otx2 free sq res never freed sq-timestamps, leaking that memory across ifdown and...

PT-2026-72296

In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but era map calculates the writeset block before applying the target offset. Tables with a non-zero start sector ca...

PT-2026-72816

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommu map sgtable return value check Commit "iommu: return full error code from iommu map sg atomic" changed iommu map sgtable to return an ssize t and negative values in error cases, rather than a size t and a...

PT-2026-72393

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the NTFS driver during mount failures. When the ntfs fill super function fails, the err out now path only frees the volume structure, failing to release other...

PT-2026-72870

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpc recvmsg oob takes a received oob message off recvmsg oobq and, if a response is needed, moves it onto the pending oobq tree. However, only the unlink from recvms...

PT-2026-72448

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Check runtime resume during probe The MT8192 AFE probe enables runtime PM temporarily while reinitializing the regmap cache from hardware, but it uses pm runtime get sync without checking the return value...

PT-2026-72497

In the Linux kernel, the following vulnerability has been resolved: tracing/remotes: Fix leak in trace remote alloc buffer error path If page allocation fails in trace remote alloc buffer, desc-nr cpus is not yet incremented for the current CPU. As a consequence, on error, half-allocated rb desc...