PT-2026-94535

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the null blk driver when a zoned device is powered off and on repeatedly. The null init zoned dev function allocates the dev-zones array during power-on, but null...

PT-2026-94528

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the mtip32xx block driver where ioctl handlers only check the REMOVE PENDING flag before calling mtip hw ioctl. This allows a device removal process to set the...

PT-2026-94570

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the NFC PN533 driver where the request skb socket buffer can be freed while the transport is still using it. This occurs because pn533 send async publishes the...

PT-2026-94572

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the NFC NCI subsystem where nci close device and nci rx work can concurrently call the nci data exchange complete function. This occurs because rx work is no...

CVE-2026-86861: Time-of-check Time-of-use (TOCTOU) Race Condition

pgAdmin 4's File Manager savefile endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.checkaccesspermission and then opened the file for writing with a plain open call. CVE-2026-7819 had previously hardened the separate file upload path by openi...

CVE-2026-92487: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: exfat: fix validsize extension over a shared writable mapping When a shared writable mapping has its validsize extended by a buffered write or a page fault, exfat zeroes the page-cache gap below the new validsize. A store through...

PT-2026-94573

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the NFC LLCP module. The function nfc llcp getsockopt reads the llcp sock-local pointer before acquiring the socket lock via lock socksk. Simultaneously, llcp...

CVE-2026-93169: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dmaengine: zynqmpdma: fix race between runtime PM and device removal In zynqmpdmaremove, runtime PM was disabled only after checking state and doing a manual suspend. This can race with runtime PM in the remove/unbind rmmod path...

PT-2026-94659

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the thermal hwmon implementation where the system creates one hwmon device per thermal zone type, registering it under the first thermal zone of that type. This causes...

CVE-2026-90400: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync removespares and removeandaddspares modify the array's rdev configuration. These operations are only safe after the array has been suspended. mdstartsync checks whether spare...

CVE-2026-93073: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE -- once for the NULL check and once for the indirect notifyfailure call. A concurrent fsputdax can clear...

CVE-2026-93092: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unregister device notifier before IDR teardown The requested-devices notifier looks up protocol fwnodes from the activeprotocols IDR. During remove, unregister the notifier before releasing and destroying...

CVE-2026-24075: Buffer Over-read

Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions...

CVE-2026-25278: Time-of-check Time-of-use (TOCTOU) Race Condition

Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying...

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow CVE-2026-23172 kernel: xfrm: hold dev ref until after transportfinish NFHOOK CVE-2026-31663 kernel: RDMA/rxe: Fix race...

ALSA-2026:68570 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow CVE-2026-23172 kernel: xfrm: hold dev ref until after transportfinish NFHOOK CVE-2026-31663 kernel: RDMA/rxe: Fix race...

PT-2026-94145

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs during the processing of I2C transfer requests. This issue is caused by a race condition, which is a situation where the timing or order...

PT-2026-94142

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs in the device control handler when multiple threads issue concurrent IOCTL Input/Output Control requests. This issue is caused by improp...

PT-2026-94728

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the mt76 rx poll complete function due to a race condition. This occurs when a Station STA has been removed, but the rx status still maintains a pointer ...

PT-2026-94584

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Network File System server NFSD where the free ol stateid reaplist function frees open and lock stateids by calling -sc free directly, bypassing the path used by...