Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.11. It stems from s390/pai failing to handle situations where the PMU stop callback is invoked repeatedly, potentially leading to improper handling of sampling events...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.1. It arises because after a power event is registered, its callback may be triggered immediately by other contexts. If the power is disabled while the externalpowerchanged callback is still executing, the driver data may have already been...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.18. It stems from cifsdotruncate in the SMB client, which fails to hold irwsem or invalidatelock when performing refresh and truncate operations. Concurrent buffer writes may result in data corruption...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.11. It stems from the fact that DRM/xe/oa fails to zero out OA buffer allocations; additionally, when allocating OA buffers via DRMXEOAPROPERTYOADISABLED, xeoainitoabuffer is not called. As a result, ttmbotypekernel buffers may contain dat...

PT-2026-128200

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayed cmd lock target do delayed work takes dev-delayed cmd lock with a plain spin lock. It runs from system percpu wq, so interrupts stay enabled while the lock is held. Every oth...

PT-2026-128111

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using check mul overflow before calculating the firmware payload size. Reject zero-length payloads and zero...

PT-2026-128180

In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf pmu migrate context leaving events behind perf pmu remove walks the group leaders of a CPU and PMU with perf event groups for cpu pmu, removing each one as it goes. perf remove from context takes the leader out of...

PT-2026-128144

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions allocate usb4 bandwidth for stream and allocate usb4 bandwidth both use ASSERTstream-sink before dereferencing stream-sink-link. ASSERT is compiled out in...

CVE-2026-99176: Linux: In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Reset MMU back to the root MMU if…

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "not from VM-Entry" case, i.e. when emulating RSM or handling...

PT-2026-128181

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac1000: clear the RGMII status interrupt Since commit 2e2c878a3141 "net: stmmac: remove SGMII/RGMII/SMII interrupt handling" nothing on the RGMII path reads GMAC RGSMIIIS, so RGSMIIIS stays pending behind GMAC INT...

CVE-2026-99103: Linux: In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix unbound pool lifetime for pending…

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix unbound pool lifetime for pending pwqs KASAN reports a use-after-free of an unbound workerpool in nodeactivatependingpwq: BUG: KASAN: slab-use-after-free in rawspintrylock+0x6d/0x120 Read of size 4 at addr...

CVE-2026-99201

In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace pointer The netlink rhashtable key includes a raw struct net pointer and a user-controlled port ID. Both /proc/net/netlink and socket diagnostics expose the table's bucket order. By...

CVE-2026-99176

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "not from VM-Entry" case, i.e. when emulating RSM or handling...

CVE-2026-99127

In the Linux kernel, the following vulnerability has been resolved: pagepool: keep fragoffset aligned for odd-sized requests pagepoolallocfragnetmem rounds the requested fragment size with size = ALIGNsize, dmagetcachealignment; dmagetcachealignment returns 1 unless the architecture defines...

CVE-2026-99168

In the Linux kernel, the following vulnerability has been resolved: mshvvtl: Check per-CPU register page before mmap Register-page setup is optional for each CPU. If allocation or registration fails, mshvvtlconfigureregpage warns and leaves that CPU's regpage NULL, but initial context setup...

CVE-2026-99171: Linux: In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the…

In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfsputsuper and ntfs3killsb drop the in...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.18.59 and prior to 7.2.13. This vulnerability arises when, in NMI context, the kernel processes a PF value; it fails to properly read and clear an interrupted asynchronous PF flag, potentially leading to a kernel crash...

CVE-2026-99188

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac1000: clear the RGMII status interrupt Since commit 2e2c878a3141 "net: stmmac: remove SGMII/RGMII/SMII interrupt handling" nothing on the RGMII path reads GMACRGSMIIIS, so RGSMIIIS stays pending behind GMACINTMA...

CVE-2026-99189

In the Linux kernel, the following vulnerability has been resolved: gpio: mxc: fix race between chained IRQ handler install and probe completion mxcupdateirqchainedhandler is called before the IRQ domain, the generic IRQ chip, and the port list entry are set up. If an interrupt arrives in that...

CVE-2026-99158

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in ringbuffermapgetreader The mmap reader can warn when it catches up with a writer that is still committing events. rbgetreaderpage returns NULL in this case, but ringbuffermapgetreader treats that...