PT-2026-72823

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with event input event process midi borrows msynth-output rfile.output and then passes the substream to dump midi and snd rawmidi kernel write without synchronizing with the output...

PT-2026-72763

In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix NULL pointer dereference in is vm area hugepages find vm area can return NULL if the given address is not a valid vmalloc area. Check the return value before dereferencing it to avoid a kernel crash...

PT-2026-72699

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: check skb clone in control TX t7xx port ctrl tx clones each skb fragment before passing it to the port transmit path. The clone is used immediately to set cloned-len, so an skb clone failure results in a NULL...

PT-2026-72861

In the Linux kernel, the following vulnerability has been resolved: afs: handle CB.InitCallBackState3 requests without a server record The cache manager callback path now attaches the server record to an incoming call through the rxrpc peer's app data. That association is not guaranteed to exist...

PT-2026-72351

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL h transaction deref in ocfs2 assure trans credits BUG A direct write over unwritten extents can panic the kernel in ocfs2 assure trans credits when the journal aborts during DIO completion. The crash is a general...

PT-2026-72430

In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sk socket dereference in selinux sctp bind connect selinux sctp bind connect dereferences sk-sk socket to pass a struct socket to selinux socket bind and selinux socket connect helper. However, when the hook is...

PT-2026-72550

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Fix NULL pointer dereference in xe pt zap ptes entry The page-table walk framework may pass a NULL child pointer for unpopulated entries. xe pt zap ptes entry called container ofchild before checking for NULL, then...

Linux Distros Unpatched Vulnerability : CVE-2026-72147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dmaengine: dw-edma-pcie: Reject devices without driver data dwedmapcieprobe treats the PCI device ID driverdata as the template for the controller layout and...

Linux Distros Unpatched Vulnerability : CVE-2026-72253

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfconntracksip: validate skbdst before accessing it tc ingress and openvswitch do not guarantee routing information to be available. These subsystems...

Linux Distros Unpatched Vulnerability : CVE-2026-74424

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbcon: fix NULL pointer dereference for a console without vcdata fbconnewmodelist runs when a framebuffer's modelist changes. For each console mapped to it with...

Linux Distros Unpatched Vulnerability : CVE-2026-74477

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - uprobes: Fix NULL pointer dereference in hprobeexpire Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clo...

Linux Distros Unpatched Vulnerability : CVE-2026-72392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: fib6: fix NULL deref in fib6walkcontinue on multi-batch dump inet6dumpfib saves its progress in cb-args1 as a positional index within the current hash...

PT-2026-72445

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm: fix NULL pointer dereference in graph callback When q6apm free fragments is called it frees rx data.buf/tx data.buf and sets them to NULL under graph-lock. A late DSP buffer-done response can race with this:...

PT-2026-72854

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Fix potential tracepoint null pointer dereferences Trace dma fence signaled, trace dma fence wait end and trace dma fence destroy can all currently dereference a null fence-ops pointer after it has been reset on fence...

PT-2026-72842

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlan gro prepare receive. udp tunnel sock release could set sk-sk user data to NULL while vxlan gro prepare receive is running. Let's check if rcu dereference sk user data is NULL after skb...

PT-2026-72865

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the reception of a reply packet before data transmission Fix rxrpc receiving reply to handle the reception of an apparent reply DATA packet before rxrpc has had a chance to send any request DATA packets on a client cal...

PT-2026-72678

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtw aes decrypt The null-pointer-guard was incorrect, returning FAIL on valid pointer. Invert the guard, so it returns FAIL on invalid pointer...

PT-2026-72646

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix NULL pointer dereference in unpack pdb pdb-dfa could be NULL if unpack dfa fails, causing a NULL pointer dereference...

PT-2026-72441

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack sip: validate skb dst before accessing it tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relie...

PT-2026-72531

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation mlx5e hv vhca stats create is called from mlx5e nic enable, before mlx5e open. At that point priv-stats nch is still zero, because it is only ever incremented in mlx5e...