PT-2026-72854

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Fix potential tracepoint null pointer dereferences Trace dma fence signaled, trace dma fence wait end and trace dma fence destroy can all currently dereference a null fence-ops pointer after it has been reset on fence...

PT-2026-72950

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill max is set When a USB audio endpoint requests full packet transfers via the fill max descriptor flag, data ep set params promotes ep-curpacksize to ep-maxpacksize...

PT-2026-72178

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: lpc32xx slc: fail DMA transfer on completion timeout lpc32xx xmit dma waits for the DMA completion callback but ignores wait for completion timeout. A timed out DMA transfer is therefore unmapped and reported as...

PT-2026-72527

In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on build skb failure qede rx build skb and qede tpa rx build skb do not check for a NULL return from qede build skb. When it returns NULL under memory pressure, the functions still...

PT-2026-72943

In the Linux kernel, the following vulnerability has been resolved: of/address: Fix NULL bus dereference in of pci range parser one The bus matching rework made of match bus return NULL for nodes with ranges/dma-ranges but no local address-cells. parser init stored that NULL bus, and the range...

PT-2026-72253

In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when frag count is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call dma...

PT-2026-72892

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xe exec ioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs,...

PT-2026-72716

In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sg cleanup path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

PT-2026-72277

In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path If phys disk-in reset is set, the function returns directly without undoing the resources acquired for the command. Add the missing error cleanup by unmapping the IOACCEL2 S...

PT-2026-72336

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Add spinlock to protect DONE INT MASK and ABORT INT MASK The DONE INT MASK and ABORT INT MASK registers are shared by all DMA channels, and modifying them requires a read-modify-write sequence. Because this...

PT-2026-72664

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free In dma release channel, check chan-device-privatecnt after call dma chan put. However, dma chan put call dma device put which could release the last reference of the device if the DMA provid...

PT-2026-72851

In the Linux kernel, the following vulnerability has been resolved: spi: atcspi200: fix use-after-free when driver unbind DMA resource is initialized after SPI controller registration. So when driver unbind, this can trigger a use-after-free when DMA is torn down while the controller is still ali...

PT-2026-72721

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netif rxq cleanup unlease tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA...

PT-2026-72248

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure t7xx cldma late init creates md ctrl-gpd dmapool before initializing the TX and RX rings. If any ring initialization fails, the error path frees the already initialized...

PT-2026-73026

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix fdev setup failure cleanup in idxd cdev open The failed dev add and failed dev name paths drop the file-device reference while wq-wq lock is still held. If put devicefdev drops the last reference, idxd file d...

PT-2026-72764

In the Linux kernel, the following vulnerability has been resolved: iommufd: Destroy the pages content after detaching from dmabuf Sashiko points out this has gotten out of order, the mutex could still be in use through the dmabuf invalidation callbacks. Don't destroy any of the pages content unt...

PT-2026-72997

In the Linux kernel, the following vulnerability has been resolved: rtase: fix double free of multi-frag skb on DMA map failure In rtase start xmit, when the head buffer DMA mapping fails after rtase xmit frags has mapped all fragments, the error path clears the fragment descriptors with rtase tx...

PT-2026-72337

In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra: Fix burst size calculation Currently, the Tegra GPC DMA hardware requires the transfer length to be a multiple of the max burst size configured for the channel. When a client requests a transfer where the length...

PT-2026-72662

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor For architectures like Microblaze or arm64 where this IP is used, DMA DIRECT REMAP is set which means that dma alloc coherent might remap and hence vmalloc some...

Linux Distros Unpatched Vulnerability : CVE-2026-74545

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rtase: fix double free of multi-frag skb on DMA map failure In rtasestartxmit, when the head buffer DMA mapping fails after rtasexmitfrags has mapped all...