PT-2026-128094

In the Linux kernel, the following vulnerability has been resolved: ntfs: move attribute payload before shrinking its record ntfs new attr flags resizes the non-resident attribute record before moving its name and mapping pairs to their shorter-header offsets when compression or sparse state is...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.18. It stems from rocketremove decrementing numcores, while findcorefordev only searches for indices ranging from 0 to numcores - 1. When unbinding cores in order of binding, the last core is omitted, preventing numcores from reaching zero...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.8. It arises because the xeevictflags function dereferences a NULL resource when evicting a BO without a resource, potentially leading to a null pointer dereference in the kernel...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.2. It arises because hifemacdrvprobe connects to the PHY before assigning dev-netdevops; when CONFIGNETSHAPER is enabled, netdevneedopslock reads dev-netdevops. This may lead to null pointer dereferencing and kernel crashes...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 7.2.13. It arises because ntfsnewattrflags reduces the size of non-in-place attribute records before clearing compressed or sparse states; this causes memmove to copy bytes from subsequent attributes, resulting in a malformed mappi...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.0. It stems from a failure to invoke wakeuppreempt on queued tasks during changes to the scheduler class, resulting in runnable tasks being left unrescheduled and potentially causing the CPU to become idle...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.19. It stems from mshvvtlfault, which checks only the global mshvhasregpage flag without examining the register page of the selected CPU. This may lead to a null pointer dereference in getpageNULL when a mapping failure occurs in user spac...

PT-2026-128204

In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKF NET OFF and SKF LL OFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting...

PT-2026-128197

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs reads Recovery participant records must remain alive while debug state print walks reco.node data and formats their fields. The formatter holds dlm-spinlock, but the recovery...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.19. It stems from dwmac1000 failing to clear RGMII state interrupts, which can lead to an interrupt storm caused by pending interrupt states. This prevents recovery threads from running, potentially resulting in soft lockouts, watchdog...

CVE-2026-99193

In the Linux kernel, the following vulnerability has been resolved: net: ti: icssm-prueth: Move setting of netops to fix crash icssmpruethnetdevinit calls ofphygetandconnect before ndev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since...

CVE-2026-99110: Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifs_do_set_acl()…

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifsdosetacl cifssetacl validates ACL size using posixaclxattrsize: 4 + count 8 // 4-byte header + 8 bytes per ACE cifsdosetacl then calls posixacltocifs to write the CIFS wire format into the sa...

CVE-2026-99183: Linux: In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when looking…

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when looking up a scheduler schedtocore walks rdev-cores up to rdev-numcores, and rocketremove decrements numcores for every core it removes. Unbind a core that is not the last one and the cor...

PT-2026-128145

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response iscsi complete pdu fetches the task for five response types from one place and checks only that the index resolved: case ISCSI OP LOGOUT RSP: case ISCSI OP LOGIN RS...

CVE-2026-99204

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs reads Recovery participant records must remain alive while debugstateprint walks reco.nodedata and formats their fields. The formatter holds dlm-spinlock, but the recovery...

CVE-2026-99105

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix stall when a task enqueued with SCXENQLAST lands back on its CPU's local DSQ With SCXOPSENQLAST, the last runnable task on a CPU is passed to ops.enqueue instead of being kept running. Exiting tasks without...

CVE-2026-99141

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in printgraphfunctionevent tracingsettracer assigns the flags of the newly selected tracer with: tr-currenttraceflags = t-flags ? : t-tracer-flags; If the new tracer defines neither static flags nor default...

CVE-2026-99144: Linux: In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix use-after-free of a destroyed user…

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until rundeferred takes it, and the RCU callback that frees...

CVE-2026-99181: Linux: In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced…

In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofsnotifydaemon takes a reference to the current notification pipe under wqmutex, then drops the mutex before writing the request. The write can block while the daemon...

CVE-2026-99135

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix infinite loop on discard with large tag size When integritymetadata handles a discard, it fills a buffer with DISCARDFILLER and writes it over the tags, maxblocks blocks at a time. If the kmalloc fails, the buff...