CVE-2026-99155

In the Linux kernel, the following vulnerability has been resolved: scsi: xen/scsifront: Check for a NULL shadow entry on a backend response scsifrontdoresponse validates the rqid in a backend response against VSCSIIFMAXREQS before using it to index info-shadow, but then dereferences the entry to...

CVE-2026-99165

In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate output stream after association connect wait When message interleaving is enabled, the first send waits for association establishment before building its data chunks. The wait drops the socket lock, and handshake...

PT-2026-128098

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix stall when a task enqueued with SCX ENQ LAST lands back on its CPU's local DSQ With SCX OPS ENQ LAST, the last runnable task on a CPU is passed to ops.enqueue instead of being kept running. Exiting tasks without SC...

PT-2026-128192

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hip04 eth: Move setting of netops to fix crash hip04 mac probe calls of phy connect before ndev-netdev ops is assigned. phy attach direct - phy link topo add phy reads dev-netdev ops through netdev need ops lock...

Zephyr Project Zephyr buffer error vulnerability

Versions Zephyr 2.2.0 through 4.4.2 contain a buffer error vulnerability. This vulnerability arises because the GPIO system call handler in drivers/gpio/gpiohandlers.c fails to validate the pin parameter provided by user-mode callers; this may result in out-of-bounds writes of function pointers a...

PT-2026-128115

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmci transport recv stream cb looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a...

PT-2026-128127

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix data race and NULL deref on local-assoc dev local-assoc dev is shared between the association path and the association-response worker without common synchronization. mac802154 perform association stores the...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.2. It stems from iucvsockrecvmsg failing to validate the transmission type before sending AFIUCVFLAGWIN. Additionally, within the spinlock-protected region, iucvsendctrl is invoked to allocate memory, potentially allowing unprivileged...

CVE-2026-99172: Linux: In the Linux kernel, the following vulnerability has been resolved: ipc: drop the mqueue mount with kern_unmount() on…

In the Linux kernel, the following vulnerability has been resolved: ipc: drop the mqueue mount with kernunmount on setup failure mqinitns creates the mqueue mount with fcmountlongterm, so its -mntns is MNTNSINTERNAL. When setting up the mqueue or ipc sysctls or msginitns fails afterwards,...

PT-2026-128129

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.29 Linux kernel versions prior to 5.10.273 Description A race condition exists in the dm-crypt module within the crypt dec pending function. The issue occurs because the function reads the io-error variable...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.19. It arises from the process of adding a GPIO shared proxy; the lifetime of the GPIO lookup table may extend beyond the time when its name string is assigned to the kobject lookup-devid, potentially leading to use-after-free conditions...

CVE-2026-99129: Linux: In the Linux kernel, the following vulnerability has been resolved: selinux: fix BPF token permission checks Avoid…

In the Linux kernel, the following vulnerability has been resolved: selinux: fix BPF token permission checks Avoid multiple lookups of the bpffs creator SID using the token's file descriptor when the same information can be found via the resolved path/dentry in selinuxbpftokencreate or the token...

CVE-2026-99168: Linux: In the Linux kernel, the following vulnerability has been resolved: mshv_vtl: Check per-CPU register page before mmap…

In the Linux kernel, the following vulnerability has been resolved: mshvvtl: Check per-CPU register page before mmap Register-page setup is optional for each CPU. If allocation or registration fails, mshvvtlconfigureregpage warns and leaves that CPU's regpage NULL, but initial context setup...

CVE-2026-99121: Linux: In the Linux kernel, the following vulnerability has been resolved: ipv4: avoid divide by zero in fib_rebalance…

In the Linux kernel, the following vulnerability has been resolved: ipv4: avoid divide by zero in fibrebalance fibrebalance computes the total eligible nexthop weight in one pass and programs upper bounds in a second pass. A concurrent change to ignorerouteswithlinkdown can make the first pass...

CVE-2026-99198

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: actions: Move setting of netops to fix crash owlemacprobe calls owlemacphyinit, which connects the PHY, before netdev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.11. It arises because audio is processed by the HPD handler and starts before video recovery; as a result, vc4hdmiwriteinfoframe executes even when Packet RAM is disabled, potentially leading to system warnings or anomalies...

CVE-2026-99162

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix use-after-free bug when adding shared proxies The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assigning to lookup-devid. Fix a potential UAF by duplicating the...

CVE-2026-99143: Linux: In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from…

In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from program capacity predicateparse adds two to nrpreds to reserve the terminal TRUE and FALSE entries. It also uses that increased value as the limit for parsed predicates. If the...

PT-2026-128170

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sev gmem post populate set page dirty requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got...

PT-2026-128178

In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fw core handle response or split transaction timeout callback may manipulate the same transaction entry in the pending transaction...