PT-2026-72363

In the Linux kernel, the following vulnerability has been resolved: fs/proc/task mmu: fix make uffd wp huge pte prot-update race Patch series "userfaultfd/pagemap: pre-existing fixes". These are pre-existing bug fixes that were carried at the front of the userfaultfd RWP working-set-tracking seri...

PT-2026-72377

In the Linux kernel, the following vulnerability has been resolved: ntfs: fail attrlist updates when the superblock is inactive generic shutdown super clears SB ACTIVE before evicting cached inodes. If eviction selects the fake inode for a base inode's unnamed $ATTRIBUTE LIST attribute, ntfs evic...

PT-2026-72221

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, fix matcher leak on resize target setup failure hws bwc matcher move allocates a replacement matcher before setting it as the resize target. If mlx5hws matcher resize set target fails, the replacement matcher is no...

PT-2026-72226

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Initialize eth syslock spinlock before use lan743x hardware init calls pci11x1x strap get status during the PCI11x1x probe sequence. That helper acquires the Ethernet subsystem hardware lock via lan743x hs syslock...

PT-2026-72218

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: bound device offsets in the MUX downlink decoder mux dl adb decode walks a chain of aggregated datagram tables using offsets and lengths taken from the modem. first table index, next table index, table length,...

PT-2026-72222

In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fill from part fill from part computes the size of a directory entry in size t but stores it in a u32. An entry length near U32 MAX wraps it to a small value, bypasses the bounds...

PT-2026-72225

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch multiq: Replace direct dequeue call with peek and qdisc dequeue peeked multiq dequeue takes a packet from a band's child with a direct -dequeue call after multiq peek peeked it. When the child is non-work-conservin...

PT-2026-72505

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpc clnt across the TLS connect worker The TLS connect path has a use-after-free: nothing pins the upper rpc clnt across the delayed connect worker. xs connect stores task-tk client in sock xprt::clnt as a raw...

PT-2026-72167

In the Linux kernel, the following vulnerability has been resolved: liveupdate: validate session type before performing operation The sessions ioctls are not applicable to all session types. PRESERVE FD is only applicable to outgoing sessions. RETRIEVE FD and FINISH are only valid for incoming...

PT-2026-72380

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound to move in indx insert into root before hdr insert head indx insert into root promotes a full resident $INDEX ROOT into $INDEX ALLOCATION and copies all non-last resident root entries into a newly allocated INDEX...

PT-2026-72514

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...

PT-2026-72516

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdna umap lifetime race amdxdna umap release calls the blocking mmu interval notifier remove before removing the object from abo-mem.umap list. If aie2 populate range runs concurrently, it may obta...

PT-2026-72402

In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-battery: Fix missing nvmem device put causing reference leak In cpcap battery detect battery type, the reference to an nvmem device obtained via nvmem device find is not released with nvmem device put on the...

PT-2026-72191

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbt parse firmware copies patch length - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction...

PT-2026-72484

In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETH HLEN to be pullable in ife decode ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes the decapsulated packet to eth type trans, which expects the inner...

PT-2026-72339

In the Linux kernel, the following vulnerability has been resolved: tpm: tpm2-sessions: wait for async KPP completion in tpm buf append salt tpm buf append salt in drivers/char/tpm/tpm2-sessions.c calls crypto kpp generate public key and crypto kpp compute shared secret without installing a...

PT-2026-72510

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary...

PT-2026-72175

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: use pm runtime resume and get in suspend Replace pm runtime get sync with pm runtime resume and get to simplify error handling. pm runtime resume and get automatically drops the usage counter on failure,...

PT-2026-72829

In the Linux kernel, the following vulnerability has been resolved: drm/syncobj: Fix memory leak in drm syncobj find fence Commit 18226ba52159 "drm/syncobj: reject invalid flags in drm syncobj find fence" forgot to take into account the fact that drm syncobj find takes a reference to syncobj and...

PT-2026-72818

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls bpf: prevent unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in cls bpf offload cmd. Reproducer on netdevsim: add a skip sw cls bpf filter, set the bpf tc accept debugfs knob to 0, then...