CVE-2026-99146

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmcinfo-startmmioaddr and later used by dmcloadprogram. Unlike the MMIO address table, the firmware loa...

CVE-2026-99142

In the Linux kernel, the following vulnerability has been resolved: tracing: Check operator stack capacity before pushing predicateparse uses the first operator stack entry before processing any opening parentheses. A push then increments top before writing. The existing check still permits that...

CVE-2026-99144

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until rundeferred takes it, and the RCU callback that frees...

CVE-2026-99147

In the Linux kernel, the following vulnerability has been resolved: drm/exec: don't immediately add prelocked obj to array of locked objs When a contention is detected the drmexec object grabs a reference to the contended object, unlocks all other objects and pre-locks the contended one before...

PT-2026-128134

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in print graph function event tracing set tracer assigns the flags of the newly selected tracer with: tr-current trace flags = t-flags ? : t-tracer-flags; If the new tracer defines neither static flags nor...

PT-2026-128135

In the Linux kernel, the following vulnerability has been resolved: tracing: Check operator stack capacity before pushing predicate parse uses the first operator stack entry before processing any opening parentheses. A push then increments top before writing. The existing check still permits that...

CVE-2026-99200

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hisifemac: Move setting of netops to fix crash hisifemacdrvprobe connects the PHY before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commi...

CVE-2026-99141: Linux: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in print_graph_function_event()…

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in printgraphfunctionevent tracingsettracer assigns the flags of the newly selected tracer with: tr-currenttraceflags = t-flags ? : t-tracer-flags; If the new tracer defines neither static flags nor default...

CVE-2026-99144: Linux: In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix use-after-free of a destroyed user…

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until rundeferred takes it, and the RCU callback that frees...

PT-2026-128138

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change Pinned bos have their pages removed from the shrinker's shrinkable / purgeable counts on pin, and added back on unpin according to the bo's purgeable...

PT-2026-128140

In the Linux kernel, the following vulnerability has been resolved: drm/exec: don't immediately add prelocked obj to array of locked objs When a contention is detected the drm exec object grabs a reference to the contended object, unlocks all other objects and pre-locks the contended one before...

PT-2026-128208

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: prevent unregistering a power supply while a callback runs Once a power supply is registered, its callbacks can immediately start firing from other contexts, such as external power changed triggered by the TC...

PT-2026-128121

In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctp inq pop currently accepts shorter declared lengths. A zero-length chunk leaves chunk end at the current header. Whe...

PT-2026-128124

In the Linux kernel, the following vulnerability has been resolved: xfs: fix capability check in xfs An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged to, even though quotas were enforced on both gids and the...

PT-2026-128155

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix use-after-free bug when adding shared proxies The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assigning to lookup-dev id. Fix a potential UAF by duplicating the...

PT-2026-128137

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until run deferred takes it, and the RCU callback that fre...

PT-2026-128147

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parse pdu itt A transport that implements parse pdu itt hands libiscsi an index taken from the PDU, and both lookups bound it from above only: if i = session-cmds max i and cmds m...

UBUNTU-CVE-2026-99108

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix FITRIM range alignment ntfstrimfs aligns the start of a free extent up to the device discard granularity, but derives the discard length by aligning the original extent length down. When the free extent start is not...

PT-2026-128206

In the Linux kernel, the following vulnerability has been resolved: vsock: treat TCP CLOSING as once-established Handle the TCP ESTABLISHED - TCP CLOSING transition on OP RST, which can race with the connect loop. Immediately break and return 0 on ESTABLISHED/CLOSING. The return value of connect...

CVE-2026-99145

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change Pinned bos have their pages removed from the shrinker's shrinkable / purgeable counts on pin, and added back on unpin according to the bo's purgeable...