PT-2026-72218

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: bound device offsets in the MUX downlink decoder mux dl adb decode walks a chain of aggregated datagram tables using offsets and lengths taken from the modem. first table index, next table index, table length,...

PT-2026-72222

In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fill from part fill from part computes the size of a directory entry in size t but stores it in a u32. An entry length near U32 MAX wraps it to a small value, bypasses the bounds...

PT-2026-72225

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch multiq: Replace direct dequeue call with peek and qdisc dequeue peeked multiq dequeue takes a packet from a band's child with a direct -dequeue call after multiq peek peeked it. When the child is non-work-conservin...

PT-2026-72167

In the Linux kernel, the following vulnerability has been resolved: liveupdate: validate session type before performing operation The sessions ioctls are not applicable to all session types. PRESERVE FD is only applicable to outgoing sessions. RETRIEVE FD and FINISH are only valid for incoming...

PT-2026-72402

In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-battery: Fix missing nvmem device put causing reference leak In cpcap battery detect battery type, the reference to an nvmem device obtained via nvmem device find is not released with nvmem device put on the...

PT-2026-72191

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbt parse firmware copies patch length - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction...

PT-2026-72484

In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETH HLEN to be pullable in ife decode ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes the decapsulated packet to eth type trans, which expects the inner...

PT-2026-72339

In the Linux kernel, the following vulnerability has been resolved: tpm: tpm2-sessions: wait for async KPP completion in tpm buf append salt tpm buf append salt in drivers/char/tpm/tpm2-sessions.c calls crypto kpp generate public key and crypto kpp compute shared secret without installing a...

PT-2026-72175

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: use pm runtime resume and get in suspend Replace pm runtime get sync with pm runtime resume and get to simplify error handling. pm runtime resume and get automatically drops the usage counter on failure,...

PT-2026-72859

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix leak when pinning ubuf pages When pin user pages fast returns fewer pages than requested, the pages that were successfully pinned are not released, leading to a leak. Fix this by unpinning any partially pinned...

PT-2026-72832

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure mlx5r umr update xlt allocates and DMA maps an XLT buffer with mlx5r umr create xlt. The buffer is released by the common cleanup path through mlx5r umr unmap free xlt. After...

PT-2026-72560

In the Linux kernel, the following vulnerability has been resolved: afs: Fix lack of locking around modifications of net-cells dyn ino Fix the lack of locking around modifications of net-cells dyn ino by taking net-cells lock exclusively. This also requires to cell to be removed from net-cells dy...

PT-2026-72532

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable mlx5 lag get dev seq will return error when the peer isn't in the LAG or when no device is marked as master. Result bad memory access and kernel crash1. Hence, ski...

PT-2026-72840

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix snp filter reserved mem regions off-by-one Sashiko notes: regarding the bounds check in snp filter reserved mem regions called via walk iomem res desc: does the check if range list-num elements 16 + 8 PAGE SIZE...

PT-2026-72830

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check imm buf-len is a user-controlled uint32 t received from the network. Adding it to imm data offset without overflow checking allows a malicious initiator to send...

PT-2026-72867

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential infinite loop in rxrpc recvmsg Fix the wait in rxrpc recvmsg also take check the oob queue...

PT-2026-72644

In the Linux kernel, the following vulnerability has been resolved: apparmor: release exe file resources on path failure get current exe path takes both an exe file reference and a path reference before resolving the path name. If aa path name failed, it returned immediately and leaked both...

PT-2026-72536

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop The ah, hbh and rt matches check that the fixed extension header is present, then use the header length field to derive the advertised extension header lengt...

PT-2026-72583

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix passing events to regulator core Sashiko reports: Commit 754bd2b4a084 "hwmon: pmbus/core Protect regulator operations with mutex" introduced a worker to batch regulator events over time using atomic or. The delay...

PT-2026-72812

In the Linux kernel, the following vulnerability has been resolved: md/raid10: reset read slot when reusing r10bio for discard put all bios always drops devsi.bio, but it only drops devsi.repl bio when r10 bio-read slot 0. If discard reuses an r10bio that was previously used for a read, read slot...