PT-2026-72673

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresight add out conn increments nr outconns before calling devm krealloc array and again before devm kmalloc. If either allocation fails, the counter ...

PT-2026-72695

In the Linux kernel, the following vulnerability has been resolved: cifs: remove all cifs files before kill super Cifs files may be put into fileinfo put wq during umounting cifs. After umount done, cifsFileInfo put final is called, which cause following BUG: BUG: kernel NULL pointer dereference,...

PT-2026-72843

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery SSR. The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed...

PT-2026-72280

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdna drm submit execbuf passes the user-supplied command BO handle straight into amdxdna cmd submit with drv cmd == NULL. When the handle is AMDXDNA INVALID BO...

PT-2026-72442

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft fib: reject fib expression on the netdev egress hook A fib expression in a netdev egress base chain dereferences nft inpkt, NULL on the transmit path, causing a NULL pointer dereference at eval. nft fib validate...

PT-2026-72710

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fill first free targets slot during auto-discovery Any invalid endpoint decoder pointer in the target array of an active region is not allowed by cxl driver. This means cxl driver always assumes the first p-nr targets...

PT-2026-72739

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci qca: fix NULL pointer dereference in qca dmp hdr for non-serdev device hu-serdev is NULL for hci uart attached via non-serdev paths, but qca dmp hdr unconditionally dereferences hu-serdev-dev.driver-name, causing a...

PT-2026-72871

In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpc verify data ensure rx dec buffer alloc rxrpc recvmsg data calls rxrpc verify data whenever the rxrpc call.rx dec buffer is unallocated and assumes that upon successful return that rx dec buffer must be allocated...

PT-2026-72547

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bo meminfo When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle...

PT-2026-72202

In the Linux kernel, the following vulnerability has been resolved: riscv: Prevent NULL pointer dereference in machine kexec prepare A NULL pointer dereference issue is noticed in riscv's machine kexec prepare, where image-segmenti.buf might be NULL and copied unchecked. The NULL buf comes from i...

PT-2026-72534

In the Linux kernel, the following vulnerability has been resolved: platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume The driver registers two distinct WMI devices: a control device BITLAND WMI CONTROL and an event device BITLAND WMI EVENT. During the probe phase,...

PT-2026-73023

In the Linux kernel, the following vulnerability has been resolved: btrfs: skip global block reserve accounting for rescue mounts BUG Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference: BUG: kernel NULL pointer dereference, address:...

PT-2026-72894

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: avoid destroy workqueueNULL on vkms init failure Two paths through vmw vkms init can leave vmw-crc workq NULL while still leaving the rest of the driver in a state that calls vmw vkms cleanup at module unload: 1. vmw...

PT-2026-72648

In the Linux kernel, the following vulnerability has been resolved: apparmor: check label build before no new privs test aa change profile builds a replacement label with fn label build in scope before the no new privs subset check. The build helper can fail and return NULL or an ERR PTR, but the...

PT-2026-72634

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: reject stream disable with no active interface handle uaudio stream req resolves an interface index with info idx from ifnum, which returns -EINVAL when no interface matches. The enable branch and the...

PT-2026-72573

In the Linux kernel, the following vulnerability has been resolved: tracing/fprobe: Fix NULL pointer dereference in fprobe fgraph entry fprobe fgraph entry sizes a shadow-stack reservation in one walk of the per-ip fprobe list and fills it in a second walk, both under rcu read lock only. A fprobe...

PT-2026-72565

In the Linux kernel, the following vulnerability has been resolved: afs: Remove setting of AS RELEASE ALWAYS for symlinks and mountpoints Regular AFS files correctly use afs file aops which have release folio set as netfs release folio, so AS RELEASE ALWAYS is valid for them when fscache is enabl...

PT-2026-72591

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcp find fc interface currently selects the first vendor-specific...

PT-2026-72349

In the Linux kernel, the following vulnerability has been resolved: ocfs2: add journal NULL check in ocfs2 checkpoint inode During unmount, ocfs2 journal shutdown frees the journal and sets osb-journal to NULL. Later, when VFS evicts remaining cached inodes, ocfs2 evict inode - ocfs2 clear inode ...

PT-2026-72293

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject option groups without values The pcache target parses optional arguments as name/value pairs. A table that advertises one optional argument and supplies only a recognized option name, for example "cache mode",...