PT-2026-72553

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix writethrough to use collection offload Fix writethrough write to set NETFS RREQ OFFLOAD COLLECTION on the request so that collection is processed asynchronously rather than only right at the end - and also so that...

PT-2026-72594

In the Linux kernel, the following vulnerability has been resolved: net: sungem: fix probe error cleanup gem init one calls gem remove one when register netdev fails. gem remove one unregisters and frees resources owned by the net device, including the DMA block, MMIO mapping, PCI regions, and th...

PT-2026-72769

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-legacy: Bound DAI link iteration create sdw dailinks walks soc dais until it finds an entry with initialised cleared, but soc dais is allocated with exactly num ends entries. If all entries are initialised, the...

PT-2026-72806

In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix TOCTOU race in luo session retrieve Extend the scope of the rwsem read lock in luo session retrieve to overlap with the acquisition of the session mutex. This prevents a concurrent thread from releasing and freein...

PT-2026-72510

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary...

PT-2026-72614

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer spill metadata during half-slot cleanup clean func state cleans dead stack slots in 4-byte halves. When the high half of a STACK SPILL slot is dead and the low half remains live, cleanup converts the live lo...

PT-2026-72970

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix list corruption in allocate file region entries allocate file region entries tops up resv-region cache with freshly allocated file region descriptors. The allocation uses GFP KERNEL, so resv-lock is dropped around...

PT-2026-72698

In the Linux kernel, the following vulnerability has been resolved: kcm: use WRITE ONCE when changing lower socket callbacks kcm attach replaces a live lower TCP socket's sk data ready and sk write space callbacks with KCM handlers, and kcm unattach restores them later. Those callback-pointer...

PT-2026-72725

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't dump dying fib info in fib leaf notify. syzbot reported use-after-free in nsim fib4 prepare event. 0 The problem is that the following functions call fib info hold / refcount inc while dumping fib info under RCU,...

PT-2026-72477

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating it vgic prune ap list drops both ap list lock and irq lock while migrating an interrupt to another vCPU. After reacquiring the locks it only checks that the...

PT-2026-72294

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitset size overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to region count overflow" made sure that region count could fit in an unsigned int. But the bitmap memory isn't allocat...

PT-2026-72610

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn-preauth info in concurrent SMB2 NEGOTIATE conn-preauth info is shared connection state struct preauth integrity info, kmalloc-96 that is allocated and freed by the SMB2 NEGOTIATE handler and read...

PT-2026-72351

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL h transaction deref in ocfs2 assure trans credits BUG A direct write over unwritten extents can panic the kernel in ocfs2 assure trans credits when the journal aborts during DIO completion. The crash is a general...

PT-2026-72984

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Validate length before parsing diagnostics TLV btintel diagnostics accesses tlv-val0 without first validating that the diagnostics VSE is long enough to contain that field, so may cause reading data beyond the...

PT-2026-72469

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: account pKVM reclaim against the VM mm Protected guest faults charge long term pins to the VM's mm. Teardown can run later from file release, where current-mm may be unrelated. Drop the charge from kvm-mm instead...

PT-2026-72597

In the Linux kernel, the following vulnerability has been resolved: net: mvneta: re-enable percpu interrupt on resume On Marvell MPIC platforms Armada 370/XP/38x, mvneta uses a percpu IRQ disable/enable scheme for NAPI: the ISR mvneta percpu isr calls disable percpu irq to mask the MPIC per-CPU...

PT-2026-72511

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmp gq start timer A race condition exists between device teardown inetdev destroy and incoming IGMP query processing igmp rcv, leading to a Use-After-Free in the IGMP timer callback. During devi...

PT-2026-72976

In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove remove pud mapping and remove p4d mapping obtain a child table base with pud offsetp4dp, 0 and p4d offsetpgd, 0, then add the index for addr. RISC-V folds...

PT-2026-72848

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pci get drvdata type in AER handlers rtw88 stores an ieee80211 hw pointer via pci set drvdata at probe time, but io error detected and io resume retrieve it as a net device pointer. This causes netif device...

PT-2026-72380

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound to move in indx insert into root before hdr insert head indx insert into root promotes a full resident $INDEX ROOT into $INDEX ALLOCATION and copies all non-last resident root entries into a newly allocated INDEX...