CVE-2026-64120 net: ethtool: fix NULL pointer dereference in phy_reply_size

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: fix NULL pointer dereference in phyreplysize In phypreparedata, several strings such as 'name', 'drvname', 'upstreamsfpname', and 'downstreamsfpname' are allocated using kstrdup. However, these allocations were not...

CVE-2026-63857

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airohadevxmit The transmit loop in airohadevxmit reads fragment address and length during its final iteration, when the loop index equals skbshinfoskb-nrfrags, at which...

EUVD-2026-45724

In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zramwritebackendio A crash was observed in zramwritebackendio due to a NULL pointer dereference in wakeup. The root cause is a race condition between the bio completion handler zramwritebackendio and t...

CVE-2026-63857

In the Linux kernel, CVE-2026-63857 affects the airoha net code where the transmit loop in airoha_dev_xmit() reads fragment address/length on the last iteration (skb_shinfo(skb)->nr_frags) when the fragment data is uninitialized. The issue is unsafe reads that could trigger a page fault. The f...

CVE-2026-63857 net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airohadevxmit The transmit loop in airohadevxmit reads fragment address and length during its final iteration, when the loop index equals skbshinfoskb-nrfrags, at which...

CVE-2026-63857 net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airohadevxmit The transmit loop in airohadevxmit reads fragment address and length during its final iteration, when the loop index equals skbshinfoskb-nrfrags, at which...

CVE-2026-63804

In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs2qddealloc gfs2qddealloc, called as an RCU callback from gfs2qddispose, accesses the superblock object sdp through qd-qdsbd after freeing qd. It does so to decrement sdquotacount and wake up...

CVE-2026-63821 wifi: rtw88: usb: fix memory leaks on USB write failures

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtwusbwriteport fails to submit a USB Request Block URB e.g., due to device disconnect or ENOMEM, the completion callback is never executed. Currently, the driver...

CVE-2026-63809 bpf: use kvfree() for replaced sysctl write buffer

In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree for replaced sysctl write buffer procsyscallhandler allocates its temporary sysctl buffer with kvzalloc and passes it to cgroupbpfrunfiltersysctl. Since kvzalloc may fall back to vmalloc for large allocations,...

EUVD-2026-45470

In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs2qddealloc gfs2qddealloc, called as an RCU callback from gfs2qddispose, accesses the superblock object sdp through qd-qdsbd after freeing qd. It does so to decrement sdquotacount and wake up...

CVE-2026-63800

CVE-2026-63800 — Linux kernel (pNFS use-after-free) Affected: kernel code handling pnfs_update_layout() for NFS_LAYOUT_RETURN.Cause: If pnfs_prepare_to_retry_layoutget(lo) succeeds, pnfs_put_layout_hdr(lo) runs before trace_pnfs_update_layout(), while the tracepoint still references the structure...

PT-2026-61211

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f fs: serialize DMABUF cancel against request completion ffs epfile dmabuf io complete calls usb ep free request on the completed request but leaves priv-req, the back-pointer that ffs dmabuf transfer set on...

PT-2026-61427

In the Linux kernel, the following vulnerability has been resolved: igc: fix potential skb leak in igc fpe xmit smd frame When igc fpe init tx descriptor fails, no one takes care of an allocated skb, leaking it. 1 Use dev kfree skb any on failure. Tested on an I226 adapter with the following...

PT-2026-61116

In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs update layout When hitting the NFS LAYOUT RETURN branch in pnfs update layout, the code calls pnfs prepare to retry layoutgetlo. If it succeeds, pnfs put layout hdrlo is called before trace pnfs...

PT-2026-61137

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtw usb write port fails to submit a USB Request Block URB e.g., due to device disconnect or ENOMEM, the completion callback is never executed. Currently, the driver...

K000162247: Linux kernel vulnerability CVE-2026-53109

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: powerpc/pgtable-frag: Fix bad page state in ptefragdestroy powerpc uses ptfragrefcount as a reference counter for tracking it's pte and pmd page table fragments. For PTE table, in case of Hash with 6...

CVE-2026-41154

Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access...

EUVD-2026-43034

Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access...

CVE-2026-53342 arm64: mm: call pagetable dtor when freeing hot-removed page tables

In the Linux kernel, the following vulnerability has been resolved: arm64: mm: call pagetable dtor when freeing hot-removed page tables Since 5e8eb9aeeda3 "arm64: mm: always call PTE/PMD ctor in createpgdmapping" page-table allocation on ARM64 always calls pagetablepte,pmd,pud,p4dctor. This sets...

CVE-2026-53222

In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: fix resource freeing order Commit a60fc3294a37 "ptp: rework ptpclockunregister to disable events" added a call to ptpdisableallevents which changes the configuration of pins if they support EXTTS events. In ptpocpdetach...