PT-2026-72646

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the AppArmor module within the unpack pdb function. This happens because the pdb-dfa variable can be NULL if the unpack dfa function fails, leading t...

CVE-2026-72458: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix NULL pointer dereference in unpackpdb pdb-dfa could be NULL if unpackdfa fails, causing a NULL pointer dereference...

PT-2026-72866

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the handling of ACKALL packets within the rxrpc module. The function rxrpc input ackall accepts ACKALL packets without verifying if the call is in a state that can...

PT-2026-72758

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference can occur in the mt7996 mac write txwi 80211 function. This happens when mac80211 passes info-control.vif as NULL for injected frames, such as those sent via...

PT-2026-72281

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the amdxdna cmd submit function where it unconditionally calls xdna-dev info-ops-cmd submit. While aie2 dev ops defines this callback, aie4 vf ops the AIE4 SR-IOV...

PT-2026-73023

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the btrfs module when mounting with the rescue=ibadroots option after the block group tree root or the raid stripe tree root has been corrupted. This...

CVE-2026-74327: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix NULL pointer dereference in isvmareahugepages findvmarea can return NULL if the given address is not a valid vmalloc area. Check the return value before dereferencing it to avoid a kernel crash...

CVE-2026-72097: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix a possible NULL pointer dereference Fix a possible NULL pointer dereference dmverityloadpinisbdevtrusted if the device has no table...

CVE-2026-72460: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: apparmor: check label build before nonewprivs test aachangeprofile builds a replacement label with fnlabelbuildinscope before the nonewprivs subset check. The build helper can fail and return NULL or an ERRPTR, but the result was...

PT-2026-72612

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the shared IRQ handler during the probe process of the msc313 RTC driver. The function msc313 rtc probe calls devm request irq using IRQF SHARED and...

PT-2026-72648

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the AppArmor module where the aa change profile function utilizes fn label build in scope to create a replacement label before performing a no new privs subset check. ...

CVE-2026-72091: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...

CVE-2026-74322: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996macwritetxwi80211 For injected frames e.g. via radiotap, mac80211 can pass info-control.vif = NULL, as explicitly noted in struct ieee80211txinfo. Check vif point...

PT-2026-72580

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the IPv6 forwarding information base fib6 during multi-batch dumps. The inet6 dump fib function saves progress using a positional index in cb-args1. ...

PT-2026-72349

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs during the unmount process. The function ocfs2 journal shutdown frees the journal and sets the osb-journal variable to NULL. Subsequently, when the...

PT-2026-72335

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dw-edma-pcie component of the dmaengine. The dw edma pcie probe function unconditionally copies the PCI device ID driver data to use as a template for the controll...

CVE-2026-72392: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6: fix NULL deref in fib6walkcontinue on multi-batch dump inet6dumpfib saves its progress in cb-args1 as a positional index within the current hash chain. Between batches, a concurrent fib6newtable can insert a new table...

PT-2026-72695

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A kernel NULL pointer dereference occurs in the CIFS module during the unmounting process. When CIFS files are placed into the fileinfo put wq queue during an umount operation, the...

CVE-2026-72161: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ocfs2: add journal NULL check in ocfs2checkpointinode During unmount, ocfs2journalshutdown frees the journal and sets osb-journal to NULL. Later, when VFS evicts remaining cached inodes, ocfs2evictinode - ocfs2clearinode -...

CVE-2026-72242: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sksocket dereference in selinuxsctpbindconnect selinuxsctpbindconnect dereferences sk-sksocket to pass a struct socket to selinuxsocketbind and selinuxsocketconnecthelper. However, when the hook is invoked from the...