CVE-2026-99162

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix use-after-free bug when adding shared proxies The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assigning to lookup-devid. Fix a potential UAF by duplicating the...

CVE-2026-99127: Linux: In the Linux kernel, the following vulnerability has been resolved: page_pool: keep frag_offset aligned for odd-sized…

In the Linux kernel, the following vulnerability has been resolved: pagepool: keep fragoffset aligned for odd-sized requests pagepoolallocfragnetmem rounds the requested fragment size with size = ALIGNsize, dmagetcachealignment; dmagetcachealignment returns 1 unless the architecture defines...

CVE-2026-99146

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmcinfo-startmmioaddr and later used by dmcloadprogram. Unlike the MMIO address table, the firmware loa...

CVE-2026-99143: Linux: In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from…

In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from program capacity predicateparse adds two to nrpreds to reserve the terminal TRUE and FALSE entries. It also uses that increased value as the limit for parsed predicates. If the...

PT-2026-128170

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sev gmem post populate set page dirty requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got...

PT-2026-128178

In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fw core handle response or split transaction timeout callback may manipulate the same transaction entry in the pending transaction...

CVE-2026-99125

In the Linux kernel, the following vulnerability has been resolved: s390/pai: Handle multiple PMU stop callback invocations Handle the following scenario: The kernel protects itself against a very high sampling load and throttles the sampling using: perfeventthrottle -- PMU-stop Shortly later the...

CVE-2026-99191: Linux: In the Linux kernel, the following vulnerability has been resolved: calipso: keep BIG TCP payload_len in…

In the Linux kernel, the following vulnerability has been resolved: calipso: keep BIG TCP payloadlen in calipsoskbuffsetattr calipsoskbuffsetattr adjusts payloadlen by the length of the option it inserts or resizes: payload = ntohsip6hdr-payloadlen; ip6hdr-payloadlen = htonspayload + lendelta; GR...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.12. It arises because rbmetasubbufidx fails to include a meta header when calculating the base address of the subbuffer array; this results in an index offset error. This may lead to null pointer dereferencing and the loss of previously...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.11. It arises because after obtaining a clock via ofclkget in the wmti2cprobe function, the clock is not released using clkput during subsequent operations or module unloading. This results in a leak of clock reference counts...

CVE-2026-99194: Linux: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to…

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to fix crash grethofprobe calls grethmdioinit, which connects the PHY, before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.19. It arises because when switching trackers, currenttraceflags may be set to NULL; however, the ring buffer is not cleared. As a result, printing the functiongraph entries of the previous tracker triggers dereferencing of an empty pointe...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.12. It arises because ring-buffer creates a percpu/cpuN/buffermeta file for every possible CPU; however, the buffer is allocated only after the CPU becomes online. When reading files on offline CPUs, the code in rbmstart dereferences an...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.2. It stems from improper iteration of event groups during the migration event of perfpmumigratecontext, resulting in certain event groups remaining in their original context. When a CPU is hot-plugged and removed, these event groups are...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.18. It stems from schedtocore failing to search for all allocated core slots; after unbinding a non-last core, it returns NULL without checking the return value, which may lead to null pointer dereferencing...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.15. It stems from the use of an unvalidated firmware load address by dmcloadprogram in firmware header version 3 within DMC firmware, potentially leading to the use of invalid addresses...

PT-2026-128191

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: actions: Move setting of netops to fix crash owl emac probe calls owl emac phy init, which connects the PHY, before netdev-netdev ops is assigned. phy attach direct - phy link topo add phy reads dev-netdev ops...

CVE-2026-99201: Linux: In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace…

In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace pointer The netlink rhashtable key includes a raw struct net pointer and a user-controlled port ID. Both /proc/net/netlink and socket diagnostics expose the table's bucket order. By...

CVE-2026-99117: Linux: In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: don't truncate the port group…

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: don't truncate the port group walk on teardown brmulticastdisableportctx and brmulticastdelport walk port-mglist with hlistforeachentrysafe. However, brmulticastfinddelpg can also delete other entries from the...

CVE-2026-99138: Linux: In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in…

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCCINFO dotcpgetsockopt reads icsk-icskcaops and dereferences the getinfo function pointer without rcureadlock. With BPF structops congestion control, caops can point to dynamically...