PT-2026-61217

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the USB serial keyspan driver where a sanity check is missing for the size of usa49wg indat transfers. This omission could lead to the parsing of stale or uninitialize...

PT-2026-61347

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access occurs in the ieee80211 ml epcs function when processing a PRIO ACCESS ML element PER STA PROFILE subelement. A connected WiFi 7 AP can trigger this by sending an...

PT-2026-61368

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qaic gem object mmap function where the call to remap pfn range is susceptible to mapping beyond the Virtual Memory Area VMA if the Buffer Object BO is too large...

PT-2026-61483

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm ffa firmware component where the bus match callback unconditionally dereferences the id table of FF-A drivers. Because the system assumes every driver provides...

PT-2026-61225

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A boundary check error exists in the atmel mxt ts driver within the mxt prepare cfg mem function. When a configuration file specifies an object size larger than the driver's known mxt ob...

PT-2026-61238

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vti6 siocdevprivate function where the use of dev netdev for collision lookups during tunnel migration via IFLA NET NS FD allows a tunnel to be incorrectly linked...

PT-2026-61221

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description USB Test and Measurement Class USBTMC devices may use an optional interrupt endpoint for notification messages. These messages usually include two-byte headers that define the payload...

PT-2026-61145

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ip gre component where the changelink operation does not properly verify the CAP NET ADMIN capability within the tunnel link network namespace t-net. Because the...

PT-2026-61128

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs file system within the destroy extent node function. When the FI NO EXTENT inode flag is set, the system fails to reset the length of the largest extent to 0...

PT-2026-61450

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds OOB array access occurs in the asihpi component of the ALSA Advanced Linux Sound Architecture subsystem. The find control function retrieves cached information by...

PT-2026-61325

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the rocket ioctl create bo function. The function inserts a GEM handle into the file's IDR using drm gem handle create before completing several...

PT-2026-61155

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access issue exists in the ASoC rsnd component. The component dais array is zero-initialized and populated via the rsnd dai of node function. Because the boundary check ...

PT-2026-61210

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer wrap occurs in the tb property entry valid function when calculating the sum of entry-value u32 and entry-length u16. A malicious XDomain peer can provide specific values that...

PT-2026-61090

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the vcs write function. When the console lock is temporarily released to copy data from userspace, the vc data pointer obtained from vcs vc can become stale. I...

PT-2026-61135

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the F2FS file system where a missing sanity check in the f2fs get node folio ra function can lead to a system panic. In cases involving a corrupted inode, a direct nod...

PT-2026-61070

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An inconsistency in the f2fs file system occurs during fsck operations due to the incorrect usage of nat entry flags. The function f2fs need dentry mark reads these flags without mutual...

PT-2026-61248

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A division by zero occurs in the kernel when a user writes a zero fractional part to the sampling frequency sysfs attribute. This happens within the write raw function of the scd30...

PT-2026-61071

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the udf read tagged function where CRC verification is skipped if the descCRCLength plus the size of the tag structure exceeds the block size. A specially crafted UDF...

PT-2026-61148

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel wifi mt76 driver where the mt76 sta add function fails to check if a wireless client identifier WCID has already been published. When using mt7925, th...

PT-2026-61276

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the usb typec tcpm/tcpci maxim component where the system fails to validate the header NDO against RX BYTE CNT. A malicious or malfunctioning port can send a CRC-valid...