PT-2026-128162

In the Linux kernel, the following vulnerability has been resolved: futex: Fix mm reuse handling for FUT OFF MMSHARED A FUT OFF MMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared futex with a different MM because a FUT OFF INODE waiter can be...

PT-2026-128105

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls flower: validate mask pointer after nla next fl set enc opt iterates the key's nested tunnel-option attributes with nla for each attr while advancing a single mask pointer via nla next at the bottom of each loop, s...

PT-2026-128160

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in tcf action put tcf action put decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to...

PT-2026-128131

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do tcp getsockoptTCP CC INFO do tcp getsockopt reads icsk-icsk ca ops and dereferences the get info function pointer without rcu read lock. With BPF struct ops congestion control, ca ops can point to...

PT-2026-128167

In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4 get link follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4 getblkEXT4 GET BLOCKS CACHED NOWAIT. That reads s mount state in the ASSERT of ext4 getb...

CVE-2026-99205

In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeuppreempt for queued tasks during class change Paul reported recent RCU changes exposed a lost resched where CPU idles with a rcutorture thread waiting while being completely runnable. Dumping the rq state at...

CVE-2026-99130: Linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/cancel: don't spin on local work the task…

In the Linux kernel, the following vulnerability has been resolved: iouring/cancel: don't spin on local work the task can't run iouringcancelgeneric refuses to sleep while any ring on the exiting task's tctx has local work pending. It assumes the task is that ring's submitter and that the next...

CVE-2026-99197: Linux: In the Linux kernel, the following vulnerability has been resolved: net: mv643xx: move setting of netops to fix crash…

In the Linux kernel, the following vulnerability has been resolved: net: mv643xx: move setting of netops to fix crash mv643xxethprobe connects the PHY before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commit in question, ...

CVE-2026-99124

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix leak of uninitialized kernel data in SCLP report While reporterrorwrite checks that the provided buffer is at least as large as the header struct, but not that it is large enough to contain the report with the lengt...

CVE-2026-99163: Linux: In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields…

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields In checksynthfield, when a synthetic event field is a stacktrace field-isstack and the histogram field is not a "long" stacktrace array, validation...

CVE-2026-99113

In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero the FSOBJECTIDINFORMATION buffer before filling it in smb2getinfofilesystem reports 64 bytes for FSOBJECTIDINFORMATION, that is the whole of struct objectidinfo, but writes only 46 of them: - objid is 16 bytes, and wh...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions 3.16.50 through 3.17 and 4.13. It arises because bcmgenet fails to perform unshare on shared skb prior to writing control blocks; as a result, subsequent transmissions overwrite lastcb. This causes bytes from previously completed slots to b...

CVE-2026-99177: Linux: In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in…

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sevgmempostpopulate setpagedirty requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from...

CVE-2026-99116: Linux: In the Linux kernel, the following vulnerability has been resolved: net: psp: do not inherit the Rx association on…

In the Linux kernel, the following vulnerability has been resolved: net: psp: do not inherit the Rx association on clone sk-pspassoc sits past skdontcopyend, so sockcopy copies it into every socket accepted from a listener without taking a reference, while inetsockdestruct puts for every inet...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.4. It arises because fibrebalance returns zero on its first iteration when concurrently modifying ignorerouteswithlinkdown, yet still detects a valid next hop on the second iteration, resulting in a division by zero...

PT-2026-128146

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.10.273 Description An issue exists in the libiscsi component of the Linux kernel where the iscsi handle reject function fails to properly validate the iSCSI Task Tag ITT reflected in a Reject PDU. Because the...

CVE-2026-99145: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't transfer shrinker pages for pinned…

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change Pinned bos have their pages removed from the shrinker's shrinkable / purgeable counts on pin, and added back on unpin according to the bo's purgeable...

CVE-2026-99205: Linux: In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeup_preempt() for queued tasks…

In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeuppreempt for queued tasks during class change Paul reported recent RCU changes exposed a lost resched where CPU idles with a rcutorture thread waiting while being completely runnable. Dumping the rq state at...

CVE-2026-99194

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to fix crash grethofprobe calls grethmdioinit, which connects the PHY, before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through...

CVE-2026-99215

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: prevent unregistering a power supply while a callback runs Once a power supply is registered, its callbacks can immediately start firing from other contexts, such as externalpowerchanged triggered by the TCPM...