CVE-2026-99151

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions allocateusb4bandwidthforstream and allocateusb4bandwidth both use ASSERTstream-sink before dereferencing stream-sink-link. ASSERT is compiled out in productio...

CVE-2026-99200: Linux: In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hisi_femac: Move setting of netops…

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hisifemac: Move setting of netops to fix crash hisifemacdrvprobe connects the PHY before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commi...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.2. It stems from hip04macprobe calling ofPhyConnect before assigning it to ndev-netdevops. As a result, when CONFIGNETSHAPER is enabled, the probe process crashes due to a null pointer dereference...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.4. It stems from improper handling of local work by iouring/cancel; when the ring associated with a task remains disabled, the system erroneously assumes the task is being submitted and spins waiting for it to run locally, which may cause...

PT-2026-128128

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix infinite loop on discard with large tag size When integrity metadata handles a discard, it fills a buffer with DISCARD FILLER and writes it over the tags, max blocks blocks at a time. If the kmalloc fails, the...

CVE-2026-99155

In the Linux kernel, the following vulnerability has been resolved: scsi: xen/scsifront: Check for a NULL shadow entry on a backend response scsifrontdoresponse validates the rqid in a backend response against VSCSIIFMAXREQS before using it to index info-shadow, but then dereferences the entry to...

CVE-2026-99165

In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate output stream after association connect wait When message interleaving is enabled, the first send waits for association establishment before building its data chunks. The wait drops the socket lock, and handshake...

PT-2026-128098

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix stall when a task enqueued with SCX ENQ LAST lands back on its CPU's local DSQ With SCX OPS ENQ LAST, the last runnable task on a CPU is passed to ops.enqueue instead of being kept running. Exiting tasks without SC...

PT-2026-128192

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hip04 eth: Move setting of netops to fix crash hip04 mac probe calls of phy connect before ndev-netdev ops is assigned. phy attach direct - phy link topo add phy reads dev-netdev ops through netdev need ops lock...

Zephyr Project Zephyr buffer error vulnerability

Versions Zephyr 2.2.0 through 4.4.2 contain a buffer error vulnerability. This vulnerability arises because the GPIO system call handler in drivers/gpio/gpiohandlers.c fails to validate the pin parameter provided by user-mode callers; this may result in out-of-bounds writes of function pointers a...

PT-2026-128115

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmci transport recv stream cb looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a...

PT-2026-128127

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix data race and NULL deref on local-assoc dev local-assoc dev is shared between the association path and the association-response worker without common synchronization. mac802154 perform association stores the...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.2. It stems from iucvsockrecvmsg failing to validate the transmission type before sending AFIUCVFLAGWIN. Additionally, within the spinlock-protected region, iucvsendctrl is invoked to allocate memory, potentially allowing unprivileged...

CVE-2026-99172: Linux: In the Linux kernel, the following vulnerability has been resolved: ipc: drop the mqueue mount with kern_unmount() on…

In the Linux kernel, the following vulnerability has been resolved: ipc: drop the mqueue mount with kernunmount on setup failure mqinitns creates the mqueue mount with fcmountlongterm, so its -mntns is MNTNSINTERNAL. When setting up the mqueue or ipc sysctls or msginitns fails afterwards,...

PT-2026-128129

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.29 Linux kernel versions prior to 5.10.273 Description A race condition exists in the dm-crypt module within the crypt dec pending function. The issue occurs because the function reads the io-error variable...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.19. It arises from the process of adding a GPIO shared proxy; the lifetime of the GPIO lookup table may extend beyond the time when its name string is assigned to the kobject lookup-devid, potentially leading to use-after-free conditions...

CVE-2026-99129: Linux: In the Linux kernel, the following vulnerability has been resolved: selinux: fix BPF token permission checks Avoid…

In the Linux kernel, the following vulnerability has been resolved: selinux: fix BPF token permission checks Avoid multiple lookups of the bpffs creator SID using the token's file descriptor when the same information can be found via the resolved path/dentry in selinuxbpftokencreate or the token...

CVE-2026-99168: Linux: In the Linux kernel, the following vulnerability has been resolved: mshv_vtl: Check per-CPU register page before mmap…

In the Linux kernel, the following vulnerability has been resolved: mshvvtl: Check per-CPU register page before mmap Register-page setup is optional for each CPU. If allocation or registration fails, mshvvtlconfigureregpage warns and leaves that CPU's regpage NULL, but initial context setup...

CVE-2026-99121: Linux: In the Linux kernel, the following vulnerability has been resolved: ipv4: avoid divide by zero in fib_rebalance…

In the Linux kernel, the following vulnerability has been resolved: ipv4: avoid divide by zero in fibrebalance fibrebalance computes the total eligible nexthop weight in one pass and programs upper bounds in a second pass. A concurrent change to ignorerouteswithlinkdown can make the first pass...

CVE-2026-99198

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: actions: Move setting of netops to fix crash owlemacprobe calls owlemacphyinit, which connects the PHY, before netdev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through...