Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.0. It stems from repeated lookups of the bpffs creator SID within SELinux’s BPF token permission checks; this may lead to a TOCTOU issue when users modify the token file descriptor passed to the kernel...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.19. It stems from a naming conflict wherein the loop counter idx declared in foreachinsnprefix shares the same name as a local variable in getsegregoverrideidx, causing the variable to be shadowed. This prevents termination of loops under ...

PT-2026-128175

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When ch count is smaller than blob-alh cfg.device count e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links, step = ch...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.2. It stems from connecting to the PHY before assigning netdev-netdevops, resulting in a null pointer dereference and crash during the probe process when CONFIGNETSHAPER is enabled...

PT-2026-128134

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in print graph function event tracing set tracer assigns the flags of the newly selected tracer with: tr-current trace flags = t-flags ? : t-tracer-flags; If the new tracer defines neither static flags nor...

PT-2026-128183

In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiod set array value complex on error paths A drive-by review by Sashiko reports that, after a failed call to gpiochip set multiple, gpiod set array value returns abruptly, bypassing the freeing of...

UBUNTU-CVE-2026-99208

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Zero OA buffer at allocation ttmbotypekernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kern...

PT-2026-128199

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsi update param value, causing a double-free...

CVE-2026-99167: Linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in __tcf_action_put()…

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in tcfactionput tcfactionput decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to...

CVE-2026-99101

In the Linux kernel, the following vulnerability has been resolved: ntfs: move attribute payload before shrinking its record ntfsnewattrflags resizes the non-resident attribute record before moving its name and mapping pairs to their shorter-header offsets when compression or sparse state is...

CVE-2026-99178: Linux: In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async #PF flags on a kernel…

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async PF flags on a kernel PF in NMI context An async PF "page not present" event arrives through the PF vector, and its reason sits in the per-CPU apfreason.flags until kvmhandleasyncpf reads and clears it...

CVE-2026-99134

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix data race and NULL deref on local-assocdev local-assocdev is shared between the association path and the association-response worker without common synchronization. mac802154performassociation stores the coordinato...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.19. It arises when amdgpuhmmrangealloc fails; as a result, amdgpugemuserptrioctl directly returns -ENOMEM and skips cleanup, leaving behind GEM objects, bo-parent references on VM root, and MMU notifier registrations. This may lead to...

CVE-2026-99187

In the Linux kernel, the following vulnerability has been resolved: perf: Fix perfpmumigratecontext leaving events behind perfpmuremove walks the group leaders of a CPU and PMU with perfeventgroupsforcpupmu, removing each one as it goes. perfremovefromcontext takes the leader out of the groups...

CVE-2026-99130

In the Linux kernel, the following vulnerability has been resolved: iouring/cancel: don't spin on local work the task can't run iouringcancelgeneric refuses to sleep while any ring on the exiting task's tctx has local work pending. It assumes the task is that ring's submitter and that the next...

CVE-2026-99211

In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKFNETOFF and SKFLLOFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting those...

UBUNTU-CVE-2026-99157

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

PT-2026-128150

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass reply len to bsg setup queue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSI SENSE BUFFERSIZE reply buffer per job, but struct ufs rpmb reply is 104 bytes: a 40-byte struct ufs bsg reply followed by a...

PT-2026-128198

In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeup preempt for queued tasks during class change Paul reported recent RCU changes exposed a lost resched where CPU idles with a rcutorture thread waiting while being completely runnable. Dumping the rq state a...

CVE-2026-99186

In the Linux kernel, the following vulnerability has been resolved: x86/insn-eval: Fix shadowed segment index in getsegregoverrideidx Commit 45e1dccc0653 "x86/insn: Simplify foreachinsnprefix" made foreachinsnprefix declare its own loop counter named idx. getsegregoverrideidx keeps its result in ...