CVE-2026-99201

In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace pointer The netlink rhashtable key includes a raw struct net pointer and a user-controlled port ID. Both /proc/net/netlink and socket diagnostics expose the table's bucket order. By...

CVE-2026-99176

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "not from VM-Entry" case, i.e. when emulating RSM or handling...

CVE-2026-99127

In the Linux kernel, the following vulnerability has been resolved: pagepool: keep fragoffset aligned for odd-sized requests pagepoolallocfragnetmem rounds the requested fragment size with size = ALIGNsize, dmagetcachealignment; dmagetcachealignment returns 1 unless the architecture defines...

CVE-2026-99168

In the Linux kernel, the following vulnerability has been resolved: mshvvtl: Check per-CPU register page before mmap Register-page setup is optional for each CPU. If allocation or registration fails, mshvvtlconfigureregpage warns and leaves that CPU's regpage NULL, but initial context setup...

CVE-2026-99171: Linux: In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the…

In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfsputsuper and ntfs3killsb drop the in...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.18.59 and prior to 7.2.13. This vulnerability arises when, in NMI context, the kernel processes a PF value; it fails to properly read and clear an interrupted asynchronous PF flag, potentially leading to a kernel crash...

CVE-2026-99189

In the Linux kernel, the following vulnerability has been resolved: gpio: mxc: fix race between chained IRQ handler install and probe completion mxcupdateirqchainedhandler is called before the IRQ domain, the generic IRQ chip, and the port list entry are set up. If an interrupt arrives in that...

CVE-2026-99158

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in ringbuffermapgetreader The mmap reader can warn when it catches up with a writer that is still committing events. rbgetreaderpage returns NULL in this case, but ringbuffermapgetreader treats that...

CVE-2026-99157

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

CVE-2026-99150: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference…

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr amdgpudebugfsgprread drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which...

PT-2026-128141

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpu gem object close detaches the user queue eviction fence from the BO before it checks bo va-ref count, so closing any handle of a BO removes the fence, eve...

CVE-2026-99206

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsiupdateparamvalue, causing a double-free...

PT-2026-128096

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix unbound pool lifetime for pending pwqs KASAN reports a use-after-free of an unbound worker pool in node activate pending pwq: BUG: KASAN: slab-use-after-free in raw spin trylock+0x6d/0x120 Read of size 4 at addr...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 2.6.24. It stems from the SCTP inbound parser failing to validate block lengths; it accepts declarations of length shorter than a 4-byte general header. Zero-length ASCONF blocks are returned repeatedly under the SCTP-AUTH policy, leading to...

CVE-2026-99215: Linux: In the Linux kernel, the following vulnerability has been resolved: power: supply: core: prevent unregistering a power…

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: prevent unregistering a power supply while a callback runs Once a power supply is registered, its callbacks can immediately start firing from other contexts, such as externalpowerchanged triggered by the TCPM...

CVE-2026-99193: Linux: In the Linux kernel, the following vulnerability has been resolved: net: ti: icssm-prueth: Move setting of netops to…

In the Linux kernel, the following vulnerability has been resolved: net: ti: icssm-prueth: Move setting of netops to fix crash icssmpruethnetdevinit calls ofphygetandconnect before ndev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since...

PT-2026-128169

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "not from VM-Entry" case, i.e. when emulating RSM or handling KV...

CVE-2026-99132: Linux: In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync…

In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfssyncsbbuf xfssyncsbbuf holds sb/rtsb buffer locks across a synchronous xfstranscommit, which flushes the CIL push workqueue internally. If shutdown occurs during t...

CVE-2026-99132

In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfssyncsbbuf xfssyncsbbuf holds sb/rtsb buffer locks across a synchronous xfstranscommit, which flushes the CIL push workqueue internally. If shutdown occurs during t...

CVE-2026-99133

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucvsockrecvmsg sends the HiperSockets-only AFIUCVFLAGWIN without testing the transport, so on a classic z/VM socket iucvsendctrl sizes the skb through a NULL iucv-hsdev. SOMSGLIMIT accepts...