CVE-2026-99168: Linux: In the Linux kernel, the following vulnerability has been resolved: mshv_vtl: Check per-CPU register page before mmap…

In the Linux kernel, the following vulnerability has been resolved: mshvvtl: Check per-CPU register page before mmap Register-page setup is optional for each CPU. If allocation or registration fails, mshvvtlconfigureregpage warns and leaves that CPU's regpage NULL, but initial context setup...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.11. It arises because audio is processed by the HPD handler and starts before video recovery; as a result, vc4hdmiwriteinfoframe executes even when Packet RAM is disabled, potentially leading to system warnings or anomalies...

CVE-2026-99162

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix use-after-free bug when adding shared proxies The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assigning to lookup-devid. Fix a potential UAF by duplicating the...

CVE-2026-99143: Linux: In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from…

In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from program capacity predicateparse adds two to nrpreds to reserve the terminal TRUE and FALSE entries. It also uses that increased value as the limit for parsed predicates. If the...

PT-2026-128170

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sev gmem post populate set page dirty requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got...

CVE-2026-99125

In the Linux kernel, the following vulnerability has been resolved: s390/pai: Handle multiple PMU stop callback invocations Handle the following scenario: The kernel protects itself against a very high sampling load and throttles the sampling using: perfeventthrottle -- PMU-stop Shortly later the...

CVE-2026-99191: Linux: In the Linux kernel, the following vulnerability has been resolved: calipso: keep BIG TCP payload_len in…

In the Linux kernel, the following vulnerability has been resolved: calipso: keep BIG TCP payloadlen in calipsoskbuffsetattr calipsoskbuffsetattr adjusts payloadlen by the length of the option it inserts or resizes: payload = ntohsip6hdr-payloadlen; ip6hdr-payloadlen = htonspayload + lendelta; GR...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.12. It arises because rbmetasubbufidx fails to include a meta header when calculating the base address of the subbuffer array; this results in an index offset error. This may lead to null pointer dereferencing and the loss of previously...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.11. It arises because after obtaining a clock via ofclkget in the wmti2cprobe function, the clock is not released using clkput during subsequent operations or module unloading. This results in a leak of clock reference counts...

CVE-2026-99194: Linux: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to…

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to fix crash grethofprobe calls grethmdioinit, which connects the PHY, before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.19. It arises because when switching trackers, currenttraceflags may be set to NULL; however, the ring buffer is not cleared. As a result, printing the functiongraph entries of the previous tracker triggers dereferencing of an empty pointe...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.2. It stems from improper iteration of event groups during the migration event of perfpmumigratecontext, resulting in certain event groups remaining in their original context. When a CPU is hot-plugged and removed, these event groups are...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.18. It stems from schedtocore failing to search for all allocated core slots; after unbinding a non-last core, it returns NULL without checking the return value, which may lead to null pointer dereferencing...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.15. It stems from the use of an unvalidated firmware load address by dmcloadprogram in firmware header version 3 within DMC firmware, potentially leading to the use of invalid addresses...

CVE-2026-99201: Linux: In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace…

In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace pointer The netlink rhashtable key includes a raw struct net pointer and a user-controlled port ID. Both /proc/net/netlink and socket diagnostics expose the table's bucket order. By...

CVE-2026-99209

In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource xeevictflags switches on tbo-resource-memtype to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed...

CVE-2026-99131

In the Linux kernel, the following vulnerability has been resolved: xfs: fix capability check in xfs An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged to, even though quotas were enforced on both gids and the...

CVE-2026-99122

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmcitransportrecvstreamcb looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a...

CVE-2026-99158: Linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in…

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in ringbuffermapgetreader The mmap reader can warn when it catches up with a writer that is still committing events. rbgetreaderpage returns NULL in this case, but ringbuffermapgetreader treats that...

CVE-2026-99107: Linux: In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to…

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfsattrrecordresize ntfsnewattrflags passes the wrong MFT record to ntfsattrrecordresize. When the attribute is in an extent record, ctx-mrec points to the extent but the function...