Unbreakable Enterprise kernel security update

6.12.0-206.104.4.4 - net: tun: bound receive headroom Asim Viladi Oglu Manizada Orabug: 40035126 CVE-2026-81000 - xfrm: ah6: validate routing header segmentsleft Asim Viladi Oglu Manizada Orabug: 40035125 CVE-2026-80844 - RDMA/nldev: Fix locking when accessing mr-pd Jason Gunthorpe Orabug: 400289...

PT-2026-94532

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the null blk driver where attribute store methods generated with NULLB DEVICE ATTR do not use locks when updating device configurations. Because the NULLB DEV ...

PT-2026-94839

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the dw-edma component of the dmaengine. The function dw edma abort interrupt releases the vc.lock before updating the request and status. This allows the issue...

PT-2026-94809

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ext4 file system when handling Direct I/O DIO writes to holes on no-extent inodes. When a DIO write fails and falls back to buffered I/O, an unprotected...

PT-2026-94748

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the md module where md start sync checks for spare configuration changes before acquiring the reconfig mutex. Because the rdev state can change before the mute...

PT-2026-94852

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the UIO Userspace I/O subsystem where a stale pointer is maintained during a failed registration path. After the device add function is called, the UIO device becomes...

PT-2026-94838

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the dw-edma component of the dmaengine where the pause and resume functions read and update channel state without holding the vc.lock lock. Simultaneously,...

PT-2026-94515

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd module where the close operation may abort an in-flight oplock break while another breaker holds an opinfo reference. Due to a lack of serialization during t...

PT-2026-94743

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the isp1704 charger power supply component where the remove path unregisters the notifier and power supply without waiting for queued or running work. This can lead to...

PT-2026-94795

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the exfat file system where a race condition occurs when a shared writable mapping has its valid size extended via a buffered write or a page fault. In this scenario,...

PT-2026-94948

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvme-apple driver where the apple nvme init queue function initializes queue state and marks the queue as enabled. The interrupt and request paths check the enable...

PT-2026-94888

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the arm scmi firmware component. The requested-devices notifier performs lookups of protocol fwnodes from the active protocols IDR Integer ID Management. If th...

PT-2026-94871

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the dax holder notify failure function. The function reads the holder ops variable twice without using READ ONCE, once for a NULL check and once for the indire...

PT-2026-94892

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where Get or Set Feature payloads exceeding the mailbox payload size are split into multiple mailbox commands. Because the mbox mutex only serializes individual commands...

PT-2026-94879

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm scmi firmware component where the scmi child dev find function drops the reference returned by device find child prematurely. This can lead to a race condition...

PT-2026-94633

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the scsi qla2xxx driver, the qla2x00 sysfs read vpd function performs a redundant call to ha-isp ops-read optrom. This second call occurs after the optrom mutex has been released, whi...

PT-2026-94850

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the bcm-vk module where the bcm vk sync msgq function populates message queue information and sets the msgq inited variable. Because atomic set and atomic read...

PT-2026-94945

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the mac80211 hwsim stop function when draining the data-pending queue. The process currently checks if the queue is empty using skb queue empty before calling...

PT-2026-94555

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA sequencer MIDI component where the snd midi input event function can run while a rawmidi substream is closing. This creates a race condition in snd rawmidi...

PT-2026-94965

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the zynqmp dma remove function between runtime Power Management PM and device removal. The issue occurs because runtime PM is disabled only after the system...