CVE-2026-89579: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloommapalloc has two 32-bit-specific problems when the computed bitmap reaches the U32MAX fallback case. First, BITSTOBYTESU32MAX is evaluated with 32-bit arithmetic...

PT-2026-96390

In the Linux kernel, the following vulnerability has been resolved: platform/x86: int1092: Fix potential memory leak in sar probe The memory allocated for device mode info in parse package called by sar get data is not freed in some of the error paths in sar probe. Fix that by converting to use...

CVE-2026-81016: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Propagate SMU errors and validate S2D address amdstbs2dinit discards the return value of several S2D SMU commands. When the SMU refuses a command e.g. "SMU cmd failed. err: 0xff" the failure is only noticed...

CVE-2026-89436: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix sentinel write past pcc-sinf acpipccretrievebiosdata rejects SINF packages only when pcc-numsifr is strictly less than hkey-package.count, then unconditionally writes a trailing sentinel at...

CVE-2026-89437: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: int1092: Fix potential memory leak in sarprobe The memory allocated for devicemodeinfo in parsepackage called by sargetdata is not freed in some of the error paths in sarprobe. Fix that by converting to use device...

CVE-2026-89442: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...

PT-2026-96449

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validate password input computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first...

CVE-2026-89443: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isstifgetperflevelmask and isstifgetbasefreqmask use the user-provided level as an index into perflevels via readpplevelinfo and readbflevelinfo, but neither helper validates...

CVE-2026-81013: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...

CVE-2026-89581: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...

CVE-2026-89604: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: efivarfs: Rate limit statfs handler Ravi reports that statfs may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls to the QueryVariableInfo runtime service. These calls are...

CVE-2026-89438: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

PT-2026-96532

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

CVE-2026-81011: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hpinitbiospackageattribute validates obj-package.count and then calls one of the five...

PT-2026-96574

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Add a NULL check for sst inst To be consistent with other places, add a NULL check for failed socket loading by checking isst common.sst inst...

CVE-2026-89439: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Add a NULL check for sstinst To be consistent with other places, add a NULL check for failed socket loading by checking isstcommon.sstinst...

PT-2026-90297

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A per-CPU address resolution flaw exists in the x86 BPF JIT compiler. The issue occurs when the destination of a per-CPU address MOV is an extended register R5 through R9. Due to an...

PT-2026-90467

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An off-by-one error exists in the port I/O handling of the x86 TDX implementation. The functions handle in and handle out in arch/x86/coco/tdx/tdx.c use an incorrect mask calculation via...

CVE-2026-89751: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handlein and handleout in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITSPERBYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits inste...

PT-2026-96565

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handle in and handle out in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITS PER BYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits...