CVE-2026-99145: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't transfer shrinker pages for pinned…

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change Pinned bos have their pages removed from the shrinker's shrinkable / purgeable counts on pin, and added back on unpin according to the bo's purgeable...

CVE-2026-99147: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/exec: don't immediately add prelocked obj to…

In the Linux kernel, the following vulnerability has been resolved: drm/exec: don't immediately add prelocked obj to array of locked objs When a contention is detected the drmexec object grabs a reference to the contended object, unlocks all other objects and pre-locks the contended one before...

PT-2026-128132

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do tcp getsockoptTCP CONGESTION do tcp getsockopt reads icsk-icsk ca ops-name without holding rcu read lock. Since commit 0baf26b0fcd7 "bpf: tcp: Support tcp congestion ops in bpf", icsk ca ops can poin...

PT-2026-128139

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmc info-start mmioaddr and later used by dmc load program. Unlike the MMIO address table, the firmware...

CVE-2026-99146: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address…

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmcinfo-startmmioaddr and later used by dmcloadprogram. Unlike the MMIO address table, the firmware loa...

CVE-2026-99139

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCONGESTION dotcpgetsockopt reads icsk-icskcaops-name without holding rcureadlock. Since commit 0baf26b0fcd7 "bpf: tcp: Support tcpcongestionops in bpf", icskcaops can point to...

CVE-2026-99141

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in printgraphfunctionevent tracingsettracer assigns the flags of the newly selected tracer with: tr-currenttraceflags = t-flags ? : t-tracer-flags; If the new tracer defines neither static flags nor default...

CVE-2026-99143

In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from program capacity predicateparse adds two to nrpreds to reserve the terminal TRUE and FALSE entries. It also uses that increased value as the limit for parsed predicates. If the...

CVE-2026-99146

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmcinfo-startmmioaddr and later used by dmcloadprogram. Unlike the MMIO address table, the firmware loa...

CVE-2026-99142

In the Linux kernel, the following vulnerability has been resolved: tracing: Check operator stack capacity before pushing predicateparse uses the first operator stack entry before processing any opening parentheses. A push then increments top before writing. The existing check still permits that...

CVE-2026-99144

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until rundeferred takes it, and the RCU callback that frees...

CVE-2026-99147

In the Linux kernel, the following vulnerability has been resolved: drm/exec: don't immediately add prelocked obj to array of locked objs When a contention is detected the drmexec object grabs a reference to the contended object, unlocks all other objects and pre-locks the contended one before...

PT-2026-128134

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in print graph function event tracing set tracer assigns the flags of the newly selected tracer with: tr-current trace flags = t-flags ? : t-tracer-flags; If the new tracer defines neither static flags nor...

PT-2026-128135

In the Linux kernel, the following vulnerability has been resolved: tracing: Check operator stack capacity before pushing predicate parse uses the first operator stack entry before processing any opening parentheses. A push then increments top before writing. The existing check still permits that...

CVE-2026-99200

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hisifemac: Move setting of netops to fix crash hisifemacdrvprobe connects the PHY before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commi...

CVE-2026-99141: Linux: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in print_graph_function_event()…

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in printgraphfunctionevent tracingsettracer assigns the flags of the newly selected tracer with: tr-currenttraceflags = t-flags ? : t-tracer-flags; If the new tracer defines neither static flags nor default...

CVE-2026-99144: Linux: In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix use-after-free of a destroyed user…

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until rundeferred takes it, and the RCU callback that frees...

CVE-2026-99139: Linux: In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in…

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCONGESTION dotcpgetsockopt reads icsk-icskcaops-name without holding rcureadlock. Since commit 0baf26b0fcd7 "bpf: tcp: Support tcpcongestionops in bpf", icskcaops can point to...

PT-2026-128138

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change Pinned bos have their pages removed from the shrinker's shrinkable / purgeable counts on pin, and added back on unpin according to the bo's purgeable...

PT-2026-128140

In the Linux kernel, the following vulnerability has been resolved: drm/exec: don't immediately add prelocked obj to array of locked objs When a contention is detected the drm exec object grabs a reference to the contended object, unlocks all other objects and pre-locks the contended one before...