CVE-2026-63799 sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path

In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Fix OOB clearbit when CID is MMCIDUNSET in fixup path In mmcidfixupcpustotasks, when rq-curr has the target mm and mmcid.active is set, the CID is checked with cidintransit before setting the transition bit. In per-C...

CVE-2026-63797

In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsgchrdevprobe stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsgchrdeveptdevadd. If rpmsgchrdeveptdevadd then fails, its error path...

CVE-2026-63796 ocfs2: reject oversized group bitmap descriptors

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject oversized group bitmap descriptors ocfs2validategdparent only bounds bgbits against the parent allocator's chain geometry. A malicious descriptor can still claim a bgsize/bgbits pair that exceeds the bitmap bytes th...

EUVD-2026-45462

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject oversized group bitmap descriptors ocfs2validategdparent only bounds bgbits against the parent allocator's chain geometry. A malicious descriptor can still claim a bgsize/bgbits pair that exceeds the bitmap bytes th...

CVE-2026-53395 nfsd: fix dead ACL conflict guard in nfsd4_create

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dead ACL conflict guard in nfsd4create nfsd4create steals create-crdpacl/crpacl into the local nfsdattrs via the designated initializer, then immediately sets the source pointers to NULL. The subsequent conflict guard...

CVE-2026-53387

In the Linux kernel, the vulnerability CVE-2026-53387 affects the IIO light driver for veml6075. The issue arises in veml6075_it_ms indexing: veml6075_it_ms has 5 elements, but VEML6075_CONF_IT can yield 0–7, which can lead to an out-of-bounds access when the index is >= 5. The fix adds a boun...

CVE-2026-53382 media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si

In the Linux kernel, the following vulnerability has been resolved: media: vidtv: fix NULL pointer dereference in vidtvmuxpushsi syzbot reported a general protection fault in vidtvpsitspsiwriteinto 1. vidtvmuxgetpidctx can return NULL, but vidtvmuxpushsi does not check for this before dereferenci...

CVE-2026-53376 drm/amdkfd: Add upper bound check for num_of_nodes

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add upper bound check for numofnodes drm/amdkfd: Add upper bound check for numofnodes in kfdioctlgetprocessaperturesnew. cherry picked from commit 98ff46a5ea090c14d2cdb4f5b993b05d74f3949f...

EUVD-2026-45441

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: bound nodedesc sysfs read with %.64s nodedesc64 in struct ibdevice is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason drivers/infiniband/core/sysfs.c:1307, since...

CVE-2026-53371 RDMA/ionic: bound node_desc sysfs read with %.64s

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: bound nodedesc sysfs read with %.64s nodedesc64 in struct ibdevice is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason drivers/infiniband/core/sysfs.c:1307, since...

CVE-2026-53371

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: bound nodedesc sysfs read with %.64s nodedesc64 in struct ibdevice is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason drivers/infiniband/core/sysfs.c:1307, since...

CVE-2026-53369 udf: reject descriptors with oversized CRC length

In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udfreadtagged skips CRC verification when descCRCLength + sizeofstruct tag exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC...

PT-2026-61184

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv wnd The MPTCP output path access locklessly the MPTCP-level ack seq in multiple times, using possibly different values for the data ack in the DSS option and to compute the announced r...

PT-2026-61269

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the memfd component where the SEAL WRITE seal is implied when SEAL EXEC is added to enforce W^X Write XOR Execute, a security policy ensuring memory is either writable...

PT-2026-61393

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists during the initialization of the eb tables module within the netfilter bridge. The issue occurs because nf register sockopt may complete and expose socket options...

PT-2026-61110

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel KVM SVM implementation within the sev dbg crypt function. In the encryption path handled by sev dbg encrypt user, the per-iteration transfer length is...

PT-2026-61298

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stack overflow occurs in the Linux kernel due to a recursion bypass in the tcf mirred act function. The function uses a counter sched mirred nest to limit recursion depth, but when the...

PT-2026-61325

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the rocket ioctl create bo function. The function inserts a GEM handle into the file's IDR using drm gem handle create before completing several...

PT-2026-61437

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the phy reply size function. This happens because phy prepare data uses kstrdup to allocate strings such as name, drvname, upstream sfp name, and...

PT-2026-61436

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An unprivileged local user can cause a host CPU to pin indefinitely. This occurs when L2TP CMD SESSION GET is issued on L2TP ATTR IFNAME concurrently with L2TP CMD SESSION CREATE and L2T...