PT-2026-128172

In the Linux kernel, the following vulnerability has been resolved: watch queue: Fix note pool publication race in watch queue set size There is a race between watch queue set size and post one notification. watch queue set size publishes wqueue-notes, notes bitmap, nr pages and nr notes with pla...

CVE-2026-99209

In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource xeevictflags switches on tbo-resource-memtype to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed...

CVE-2026-99156

In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix use-after-free race between stremove and stopen stremove drops the probe reference on the scsitape with krefput and only afterwards removes its index from stindexidr. If that was the last reference, scsitaperelease...

CVE-2026-99167

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in tcfactionput tcfactionput decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to...

CVE-2026-99131

In the Linux kernel, the following vulnerability has been resolved: xfs: fix capability check in xfs An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged to, even though quotas were enforced on both gids and the...

CVE-2026-99122

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmcitransportrecvstreamcb looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a...

CVE-2026-99109: Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: reject SetEA requests that do not fit…

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject SetEA requests that do not fit the request buffer CIFSSMBSetEA copies the caller's extended attribute value into the SMB request buffer without checking that it fits. The requirement is stated in the source bu...

CVE-2026-99158: Linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in…

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in ringbuffermapgetreader The mmap reader can warn when it catches up with a writer that is still committing events. rbgetreaderpage returns NULL in this case, but ringbuffermapgetreader treats that...

CVE-2026-99107: Linux: In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to…

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfsattrrecordresize ntfsnewattrflags passes the wrong MFT record to ntfsattrrecordresize. When the attribute is in an extent record, ctx-mrec points to the extent but the function...

CVE-2026-99211: Linux: In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and…

In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKFNETOFF and SKFLLOFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting those...

CVE-2026-99192

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: unshare the skb before writing the control block bcmgenet stores firstcb, lastcb and bytessent in the skb control block and reads them back on completion to free the skb and credit BQL. ethersetup leaves...

CVE-2026-99200

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hisifemac: Move setting of netops to fix crash hisifemacdrvprobe connects the PHY before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commi...

CVE-2026-99203: Linux: In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer…

In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure FSETFL and FIOASYNC decide whether to invoke -fasync before pipefasync takes pipe-mutex. Two enables of one ORDWR FIFO can therefore both enter the callback...

PT-2026-128196

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.10.273 Description A slab-use-after-free issue exists in the pipe fasync notifications. The problem occurs when fasync helper fails to allocate a writer entry after updating a reader entry for an O RDWR FIFO. I...

CVE-2026-99110

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifsdosetacl cifssetacl validates ACL size using posixaclxattrsize: 4 + count 8 // 4-byte header + 8 bytes per ACE cifsdosetacl then calls posixacltocifs to write the CIFS wire format into the sa...

CVE-2026-99209: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource…

In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource xeevictflags switches on tbo-resource-memtype to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed...

PT-2026-128193

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hisi femac: Move setting of netops to fix crash hisi femac drv probe connects the PHY before dev-netdev ops is assigned. phy attach direct - phy link topo add phy reads dev-netdev ops through netdev need ops lock...

PT-2026-128186

In the Linux kernel, the following vulnerability has been resolved: net: ti: icssm-prueth: Move setting of netops to fix crash icssm prueth netdev init calls of phy get and connect before ndev-netdev ops is assigned. phy attach direct - phy link topo add phy reads dev-netdev ops through netdev ne...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.1. It stems from improper handling of FITRIM range alignment within ntfstrimfs. When the start of the free space is not aligned with the discard granularity, it may extend the discard range beyond allocated clusters, resulting in those...

CVE-2026-99108: Linux: In the Linux kernel, the following vulnerability has been resolved: ntfs: fix FITRIM range alignment ntfs_trim_fs()…

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix FITRIM range alignment ntfstrimfs aligns the start of a free extent up to the device discard granularity, but derives the discard length by aligning the original extent length down. When the free extent start is not...