PT-2026-128128

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix infinite loop on discard with large tag size When integrity metadata handles a discard, it fills a buffer with DISCARD FILLER and writes it over the tags, max blocks blocks at a time. If the kmalloc fails, the...

CVE-2026-99155

In the Linux kernel, the following vulnerability has been resolved: scsi: xen/scsifront: Check for a NULL shadow entry on a backend response scsifrontdoresponse validates the rqid in a backend response against VSCSIIFMAXREQS before using it to index info-shadow, but then dereferences the entry to...

CVE-2026-99165

In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate output stream after association connect wait When message interleaving is enabled, the first send waits for association establishment before building its data chunks. The wait drops the socket lock, and handshake...

PT-2026-128098

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix stall when a task enqueued with SCX ENQ LAST lands back on its CPU's local DSQ With SCX OPS ENQ LAST, the last runnable task on a CPU is passed to ops.enqueue instead of being kept running. Exiting tasks without SC...

PT-2026-128192

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hip04 eth: Move setting of netops to fix crash hip04 mac probe calls of phy connect before ndev-netdev ops is assigned. phy attach direct - phy link topo add phy reads dev-netdev ops through netdev need ops lock...

Zephyr Project Zephyr buffer error vulnerability

Versions Zephyr 2.2.0 through 4.4.2 contain a buffer error vulnerability. This vulnerability arises because the GPIO system call handler in drivers/gpio/gpiohandlers.c fails to validate the pin parameter provided by user-mode callers; this may result in out-of-bounds writes of function pointers a...

PT-2026-128114

In the Linux kernel, the following vulnerability has been resolved: ipv4: avoid divide by zero in fib rebalance fib rebalance computes the total eligible nexthop weight in one pass and programs upper bounds in a second pass. A concurrent change to ignore routes with linkdown can make the first pa...

PT-2026-128174

In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofs notify daemon takes a reference to the current notification pipe under wq mutex, then drops the mutex before writing the request. The write can block while the daemon...

PT-2026-128115

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmci transport recv stream cb looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a...

PT-2026-128125

In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfs sync sb buf xfs sync sb buf holds sb/rtsb buffer locks across a synchronous xfs trans commit, which flushes the CIL push workqueue internally. If shutdown occurs...

PT-2026-128127

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix data race and NULL deref on local-assoc dev local-assoc dev is shared between the association path and the association-response worker without common synchronization. mac802154 perform association stores the...

CVE-2026-99140: Linux: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix hist trigger timestamps for buffered…

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix hist trigger timestamps for buffered events Syzkaller triggered a WARNONONCE!nest warning: WARNING: kernel/trace/ringbuffer.c:821 at ringbuffereventtimestamp Call trace: ringbuffereventtimestamp histfieldtimestamp...

PT-2026-128163

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.13 Description An issue exists in the Linux kernel where a task with root privileges in its own user namespace can bypass a locked cover on a file. This occurs because copy tree may leave out a mount of a mou...

PT-2026-128209

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.20 Linux kernel versions prior to 5.5 Description In the VMBus driver, the system fails to properly reset the connection state during error or exit paths. Specifically, the vmbus connection.conn state is forced...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.2. It stems from iucvsockrecvmsg failing to validate the transmission type before sending AFIUCVFLAGWIN. Additionally, within the spinlock-protected region, iucvsendctrl is invoked to allocate memory, potentially allowing unprivileged...

CVE-2026-99172: Linux: In the Linux kernel, the following vulnerability has been resolved: ipc: drop the mqueue mount with kern_unmount() on…

In the Linux kernel, the following vulnerability has been resolved: ipc: drop the mqueue mount with kernunmount on setup failure mqinitns creates the mqueue mount with fcmountlongterm, so its -mntns is MNTNSINTERNAL. When setting up the mqueue or ipc sysctls or msginitns fails afterwards,...

PT-2026-128129

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.29 Linux kernel versions prior to 5.10.273 Description A race condition exists in the dm-crypt module within the crypt dec pending function. The issue occurs because the function reads the io-error variable...

CVE-2026-99126

In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Prevent XID null dereference The mpcvalidatexid function sets grp-savedxid2-xid2flag2 to 0x40 to signal XID validation error. If peer XID is NULL or r/w channel pairing mismatch happens, grp-savedxid2 is never...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.19. It arises from the process of adding a GPIO shared proxy; the lifetime of the GPIO lookup table may extend beyond the time when its name string is assigned to the kobject lookup-devid, potentially leading to use-after-free conditions...

CVE-2026-99129: Linux: In the Linux kernel, the following vulnerability has been resolved: selinux: fix BPF token permission checks Avoid…

In the Linux kernel, the following vulnerability has been resolved: selinux: fix BPF token permission checks Avoid multiple lookups of the bpffs creator SID using the token's file descriptor when the same information can be found via the resolved path/dentry in selinuxbpftokencreate or the token...