PT-2026-117010

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AF XDP TX timestamp teardown NULL dereference During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to mlx5e xs...

PT-2026-116741

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvr mmu map sgl Map failure from pvr mmu map sgl interface was not returned correctly to pvr mmu map interface. This resulted in pvr mmu map interface to continue instead of...

PT-2026-117073

In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered of overlay fdt apply stores the idr alloc return value in ovcs-id before checking it. On failure the stored id is negative, free overlay changeset's "if ovcs-id" check...

PT-2026-116972

In the Linux kernel, the following vulnerability has been resolved: tty: tty port: restore TTY IO ERROR on activation failure Make sure to restore the TTY IO ERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel...

PT-2026-117014

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5 ptp init returns early on the base lan969x variants because they do not have the SPX5 FEATURE PTP flag. It also returns early when no "ptp" interrupt is described. Unbinding...

PT-2026-116674

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMM CONNINFO The RFCOMM CONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-sk state != BT CONNECTED && !rfco...

PT-2026-116884

In the Linux kernel, the following vulnerability has been resolved: iio: health: max30102: fix NULL dereference in interrupt handler The interrupt is requested in max30102 probe and stays enabled for the lifetime of the device, but indio dev-active scan mask is only valid while a buffer is enable...

PT-2026-116812

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debug info copy When debug register static fails, it clears areas, active pages and active entries but leaves the area bounds unchanged. Copying such an area, either by opening its view...

PT-2026-116936

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

PT-2026-116837

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx and Rx queue. fbnic's allocation path excludes FBNIC MAX TXQS from that layout. A 64-Tx/64-Rx configuration therefore records 128...

PT-2026-116975

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3 pci probe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pci set drvdata, while the second...

PT-2026-116729

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xe vm close and put, external-BO VMAs are queued on the contested list for deferred destruction via xe vma destroy unlocked. However, xe vm pt destroy was previously...

PT-2026-116723

In the Linux kernel, the following vulnerability has been resolved: PCI: of property: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

CVE-2026-98786: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dcsink dereferences in MST mode validation dmdpmstisportsupportmode reads aconnector-dcsink-dsccaps... for the DSC branch-throughput check, and getconvfrlbw's HDMI-PCON FRL-bandwidth path reads...

CVE-2026-98795: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5ptpinit returns early on the base lan969x variants because they do not have the SPX5FEATUREPTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the...

CVE-2026-98747: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serialcoreunregisterport port-portdev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serialcoreportdeviceadd...

PT-2026-116870

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in dat cond set storage key Some callers pass NULL as oldkey. Calling page cond set storage key will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the...

PT-2026-116686

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 "KVM: arm64: nv: Handle VNCR EL2 invalidation from MMU notifiers" introduced VNCR EL2 invalidation in both kvm nested s2 unmap and kvm neste...

PT-2026-116966

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serial core unregister port port-port dev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serial core port device add...

Linux Distros Unpatched Vulnerability : CVE-2026-98854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - of/overlay: only treat a positive changeset id as registered ofoverlayfdtapply stores the idralloc return value in ovcs-id before checking it. On failure the...