PT-2026-72452

In the Linux kernel, the following vulnerability has been resolved: fbdev: tridentfb: fix potential memory leak in trident pci probe In trident pci probe, the memory allocated for modelist using fb videomode to modelist is not freed in subsequent error paths. Fix that by calling fb destroy modeli...

PT-2026-72971

In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: don't free uninitialized dev name on error path dt remember or free map duplicates dev name for each map entry. If kstrdup const fails, dt free map frees dev name in all num maps entries, including entries th...

PT-2026-72193

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix memory leak in ieee80211 register hw If kmemdup fails while copying supported band structures, the error path jumps to fail rate. This skips rate control deinitialize and leaks the initialized local-rate ctrl...

PT-2026-72276

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfc sli4 driver resource setup The memory allocated for mboxq using mempool alloc is not freed in some of the early exit error paths. Fix that by moving the mempool free call to an earlier point...

PT-2026-72457

In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: fix potential memory leak in uvesafb probe Due to an incorrect goto label, memory allocated for modedb and modelist in uvesafb vbe init is not freed in some error paths. Fix this by updating the goto label...

PT-2026-72460

In the Linux kernel, the following vulnerability has been resolved: fbdev: radeon: fix potential memory leak in radeonfb pci register The function radeonfb pci register allocates memory for modelist by calling radeon check modes which calls fb add videomode. The memory is appended to info-modelis...

PT-2026-72831

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5 IB METHOD DEVX SUBSCRIBE EVENT links event sub into sub list before initializing the fields used by the shared error path. If eventfd ctx fdget then fails, the unwi...

PT-2026-72372

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix hole runlist memory leak in insert range error path ntfs non resident attr insert range allocates hole rl before mapping the whole runlist. If ntfs attr map whole runlist fails, the error path drops ni-runlist.lock and...

PT-2026-72737

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix URB leak in alloc mtk intr urb error path When btmtk isopkt pad fails, the previously allocated URB is not freed, leaking the urb structure. Add usb free urb before returning the error...

PT-2026-72332

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-laptop: fix missing cleanups in init error path dell init initializes several resources after dell setup rfkill, including the optional touchpad LED, keyboard backlight LED, battery hook, debugfs directory and...

PT-2026-72412

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Free arenas on btt init error paths The arenas allocated by discover arenas or create arenas are not freed on some error paths in btt init. This leaks memory when BTT initialization fails. Call free arenas from the...

PT-2026-72497

In the Linux kernel, the following vulnerability has been resolved: tracing/remotes: Fix leak in trace remote alloc buffer error path If page allocation fails in trace remote alloc buffer, desc-nr cpus is not yet incremented for the current CPU. As a consequence, on error, half-allocated rb desc...

PT-2026-72433

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix device reference leak in host1x device parse dt error path After device initialize, the embedded struct device in struct host1x device should be released through the device core with put device. In host1x device...

PT-2026-72248

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure t7xx cldma late init creates md ctrl-gpd dmapool before initializing the TX and RX rings. If any ring initialization fails, the error path frees the already initialized...

PT-2026-72803

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix inconsistent arvif state in vdev create error paths ath12k mac vdev create has three error path issues that leave arvif in an inconsistent state: 1. When ath12k wmi vdev create fails, the function returns direct...

PT-2026-72633

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: clear opened when stream enable fails On enable, subs-opened is set before the service interval is validated; an invalid interval jumps to the response label without clearing it, so the substream is wedged ...

PT-2026-72673

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresight add out conn increments nr outconns before calling devm krealloc array and again before devm kmalloc. If either allocation fails, the counter ...

PT-2026-72227

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: fix BAR resource leak on PF number failure If cn23xx get pf num fails, the function returns without unmapping either BAR. Unmap both BARs before returning from the error path. Found by manual code review...

PT-2026-72810

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix error-path detection with md cloned bio Detect the error path using md cloned bio instead of relying on r1 bio in raid1 or r10 bio-read slot in raid10, which may be NULL or -1 after splitting and resubmitting...

CVE-2026-68450

In the Linux kernel, the following vulnerability has been resolved: btrfs: free mapping node on duplicate reloc root insert addrelocroot allocates a mappingnode before inserting it into rc-relocroottree. If rbsimpleinsert finds an existing entry, it returns the existing rbnode and leaves the newl...