PT-2026-61291

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where hci dev close sync can be called during the reset path. Failure to set HCI CMD DRAIN WORKQUEUE during device close can lead to the queuin...

PT-2026-61270

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the Linux kernel within the migrate vma insert huge pmd page function. When a PMD Page Middle Directory check fails and the process jumps to unlock abort, the pag...

PT-2026-61430

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the ixgbevf driver during VEPA multicast source pruning. The function ixgbevf clean rx irq frees a socket buffer skb and continues to the next descriptor...

PT-2026-61224

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double free issue exists in the uio pci generic sva component. The uio pci sva structure is allocated using devm kzalloc within the probe function. However, the code explicitly calls...

PT-2026-61376

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfs perform write function where folio-private is not correctly manipulated between NULL, NETFS FOLIO COPY TO CACHE, group pointers, and netfs folio structures...

PT-2026-61311

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the tunnels module. The functions iptunnel pmtud build icmp and iptunnel pmtud build icmpv6 cache ip hdr and ipv6 hdr before calling skb cow. Because...

PT-2026-61306

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bridge netlink configuration path where the br setport function is called while holding the bridge lock. Because br setport can trigger dev set promiscuity, which ...

PT-2026-61223

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the omap2430 probe function. The of node putnp function is called prematurely before the final access to the np variable, which can lead to a...

PT-2026-61309

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bound access occurs in the iptunnel pmtud check icmp function when it is called while the skb transport header is not set. This happens because the system incorrectly assumes t...

PT-2026-61111

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the 9p filesystem implementation where the p9 client walk function incorrectly handles file identifiers fids during error paths. When the function is called with the...

PT-2026-61108

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null-pointer dereference occurs in the fb videomode to var function within the fbdev component. The issue arises when store modes replaces the modelist from userspace via fb new...

PT-2026-61101

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The nfsd4 create file function contains two issues related to Access Control List ACL handling. First, the return value of the nfsd4 acl to attr function is ignored. If the conversion fr...

PT-2026-61115

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write occurs in the scheduler mmcid fixup path during the execution of the mm cid fixup cpus to tasks function. In per-CPU CID mode, a task that has been newly forked or...

PT-2026-61293

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth L2CAP implementation where the l2cap ecred reconf rsp function fails to clear the chan-ident variable upon a successful ECRED reconfiguration. This diffe...

PT-2026-61434

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the ieee80211 prepare and rx handle function. The ieee80211 invoke fast rx function reads RX status via IEEE80211 SKB RXCBskb, which shares the same...

PT-2026-61305

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bridge component where the brport store function acquires the bridge lock for all attributes. This causes a problem when certain bridge port flags change, as the...

PT-2026-61350

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the RDMA/rtrs component during the cleanup process of path file creation. In the error path of the rtrs srv create path files function, the system may ca...

PT-2026-61468

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommupt component where the driver could omit PAGE SIZE from the pgsize bitmap. While technically permitted, this behavior contradicts the intended design. The fix...

PT-2026-61388

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the nvme free host mem function. The function frees dev-hmb sgt using dma free noncontiguous but fails to clear the pointer. If nvme free host mem is...

PT-2026-61442

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bcmgenet network driver where setting RBUF EEE EN and RBUF PM EN in the RBUF ENERGY CTRL register disrupts the receive RX path on GENET hardware when MAC Energy...