PT-2026-116812

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debug info copy When debug register static fails, it clears areas, active pages and active entries but leaves the area bounds unchanged. Copying such an area, either by opening its view...

PT-2026-117004

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dc state create copy for NULL in dm suspend dc state create copy can return NULL on allocation failure. dm suspend only conditionally skips dm gpureset toggle interrupts and continues execution, returning...

PT-2026-117014

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5 ptp init returns early on the base lan969x variants because they do not have the SPX5 FEATURE PTP flag. It also returns early when no "ptp" interrupt is described. Unbinding...

CVE-2026-98841: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

PT-2026-117031

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctp dev only after it is initialised mctp add dev links the new mctp dev into dev-mctp ptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a net device pointer...

PT-2026-116975

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3 pci probe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pci set drvdata, while the second...

PT-2026-116686

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 "KVM: arm64: nv: Handle VNCR EL2 invalidation from MMU notifiers" introduced VNCR EL2 invalidation in both kvm nested s2 unmap and kvm neste...

CVE-2026-98849: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: pfcp: fix socket lifetime on netdevice registration failure pfcpnewlink creates the UDP socket before registernetdevice. If registration fails after pfcpdevinit succeeds, the core calls pfcpdevuninit, which releases the socket an...

PT-2026-116936

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

PT-2026-116837

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx and Rx queue. fbnic's allocation path excludes FBNIC MAX TXQS from that layout. A 64-Tx/64-Rx configuration therefore records 128...

CVE-2026-98786: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dcsink dereferences in MST mode validation dmdpmstisportsupportmode reads aconnector-dcsink-dsccaps... for the DSC branch-throughput check, and getconvfrlbw's HDMI-PCON FRL-bandwidth path reads...

CVE-2026-98795: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5ptpinit returns early on the base lan969x variants because they do not have the SPX5FEATUREPTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the...

PT-2026-116741

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvr mmu map sgl Map failure from pvr mmu map sgl interface was not returned correctly to pvr mmu map interface. This resulted in pvr mmu map interface to continue instead of...

PT-2026-117015

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk eth soc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev eth-dummy dev. mtk probe creates that dummy device, and adds the shared tx/rx NAPI to it, only...

PT-2026-116696

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix NULL pmu ctx passed to pmu-sched task perf pmu sched task returns early when cpuctx-task ctx is set, and cpc-task epc is only non-NULL while a task context is scheduled in on this CPU. perf pmu sched task therefore...

CVE-2026-98455: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

PT-2026-116729

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xe vm close and put, external-BO VMAs are queued on the contested list for deferred destruction via xe vma destroy unlocked. However, xe vm pt destroy was previously...

PT-2026-116723

In the Linux kernel, the following vulnerability has been resolved: PCI: of property: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

PT-2026-116695

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccw device get util str The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpid to chp can retu...

PT-2026-116870

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in dat cond set storage key Some callers pass NULL as oldkey. Calling page cond set storage key will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the...