PT-2026-82967

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, MPESW, Fix missing complete on devcom error mlx5 mpesw work returned without calling complete when mlx5 lag get devcom comp returned NULL. A caller that queued the work and waited on mpesww-comp would block...

PT-2026-82958

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dw dp: Fix null-ptr-deref in dw dp remove Attempting to access driver data in the platform driver -remove callback may lead to a null pointer dereference since there is no guaranty that the component -bind callback...

PT-2026-83004

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, get ss info from atombios uses calc pll cs-ctx-logger for logging. But calc pll cs-ctx is initialized only later in calc pll max vco construct...

PT-2026-82949

In the Linux kernel, the following vulnerability has been resolved: firmware: arm scmi: Fix OOB in scmi power name get scmi power name get does not validate the domain number passed by the external caller, which may lead to an out-of-bounds access. Fix this by returning "unknown" for invalid...

PT-2026-82975

In the Linux kernel, the following vulnerability has been resolved: libbpf: Reject non-exclusive metadata maps in the signed loader The loader verifies map-sha against the metadata hash in its instructions. map-sha is calculated when BPF OBJ GET INFO BY FD is called on the frozen map. While the m...

PT-2026-82937

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: fix unaligned memory access in timestamp adjustment Use get unaligned be32 and put unaligned be32 to safely read and write the timestamp fields. This prevents performance degradation due to unaligned memory...

PT-2026-83011

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: handle missing status supplier MAX17040 does not report charger state itself, so the driver forwards POWER SUPPLY PROP STATUS to a supplier power supply. If no supplier is registered, power supply get...

PT-2026-82944

In the Linux kernel, the following vulnerability has been resolved: ocfs2: don't BUG ON an invalid journal dinode BUG A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first reports the invalid journal block and then crashes in...

PT-2026-82946

In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in in6 dev stats get dev get by index rcu could return NULL if the original physical device is unregistered. Found by Sashiko...

PT-2026-82930

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch fq codel: Do not call qdisc tree reduce backlog during peek before restoring qlen Whenever fq codel drops packets during peek, it calls qdisc tree reduce backlog. An issue arises because it calls qdisc tree reduce...

PT-2026-82948

In the Linux kernel, the following vulnerability has been resolved: pinctrl: spacemit: fix NULL check in spacemit pin set config spacemit pin set config looks up the per-pin descriptor with spacemit get pin then checks the wrong variable for failure: const struct spacemit pin spin = spacemit get...

CVE-2026-33604

An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that...

PT-2026-83243

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo admin/endpoints.py uses superuser validators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session...

PT-2026-83251

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.12.8 Yamcs versions prior to 5.13.2 Description Yamcs compiles StreamSQL query expressions to Java at runtime using Janino. The LIKE operator inserts user-supplied patterns into the generated Java source unescaped. An...

PT-2026-83296

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and...

PT-2026-83286

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private...

PT-2026-82995

In the Linux kernel, the following vulnerability has been resolved: hwmon: sht3x Fix unaligned accesses Sashiko reports: In sht3x update client, the 16-bit temperature and humidity values are extracted from a stack-allocated byte array using be16 to cpup. The pointers passed to this function are...

PT-2026-82931

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzo decompress bio validates each on-disk segment length seg len only against the workspace cbuf size, not against the compressed input size compressed len...

PT-2026-83008

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix missing mem scrub at clear key import in cca clr2cipherkey The helper function ip cprb helper uses internal buffer memory for building and processing CPRBs. After use this buffer was never scrubbed which could le...

PT-2026-82978

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2c imx reg slave, the slave pointer was assigned before pm runtime resume and get. If pm runtime resume and get failed, the error path returned without clearing i2c...