CVE-2026-99171: Linux: In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the…

In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfsputsuper and ntfs3killsb drop the in...

CVE-2026-99158

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in ringbuffermapgetreader The mmap reader can warn when it catches up with a writer that is still committing events. rbgetreaderpage returns NULL in this case, but ringbuffermapgetreader treats that...

CVE-2026-99157

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

CVE-2026-99150: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference…

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr amdgpudebugfsgprread drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which...

CVE-2026-99215: Linux: In the Linux kernel, the following vulnerability has been resolved: power: supply: core: prevent unregistering a power…

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: prevent unregistering a power supply while a callback runs Once a power supply is registered, its callbacks can immediately start firing from other contexts, such as externalpowerchanged triggered by the TCPM...

CVE-2026-99193: Linux: In the Linux kernel, the following vulnerability has been resolved: net: ti: icssm-prueth: Move setting of netops to…

In the Linux kernel, the following vulnerability has been resolved: net: ti: icssm-prueth: Move setting of netops to fix crash icssmpruethnetdevinit calls ofphygetandconnect before ndev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since...

CVE-2026-99132

In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfssyncsbbuf xfssyncsbbuf holds sb/rtsb buffer locks across a synchronous xfstranscommit, which flushes the CIL push workqueue internally. If shutdown occurs during t...

CVE-2026-99133

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucvsockrecvmsg sends the HiperSockets-only AFIUCVFLAGWIN without testing the transport, so on a classic z/VM socket iucvsendctrl sizes the skb through a NULL iucv-hsdev. SOMSGLIMIT accepts...

CVE-2026-99169

In the Linux kernel, the following vulnerability has been resolved: futex: Fix mm reuse handling for FUTOFFMMSHARED A FUTOFFMMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared futex with a different MM because a FUTOFFINODE waiter can be requeue...

CVE-2026-99102

In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidatelock in ntfssetattrsize ntfssetattrsize updates isize and resizes the on-disk attribute without holding mapping-invalidatelock. Page faults take the lock shared, so a fault racing the resize can resolve a VCN...

CVE-2026-99102: Linux: In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidate_lock in ntfs_setattr_size()…

In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidatelock in ntfssetattrsize ntfssetattrsize updates isize and resizes the on-disk attribute without holding mapping-invalidatelock. Page faults take the lock shared, so a fault racing the resize can resolve a VCN...

CVE-2026-99186: Linux: In the Linux kernel, the following vulnerability has been resolved: x86/insn-eval: Fix shadowed segment index in…

In the Linux kernel, the following vulnerability has been resolved: x86/insn-eval: Fix shadowed segment index in getsegregoverrideidx Commit 45e1dccc0653 "x86/insn: Simplify foreachinsnprefix" made foreachinsnprefix declare its own loop counter named idx. getsegregoverrideidx keeps its result in ...

PT-2026-128123

In the Linux kernel, the following vulnerability has been resolved: io uring/cancel: don't spin on local work the task can't run io uring cancel generic refuses to sleep while any ring on the exiting task's tctx has local work pending. It assumes the task is that ring's submitter and that the nex...

CVE-2026-99183

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when looking up a scheduler schedtocore walks rdev-cores up to rdev-numcores, and rocketremove decrements numcores for every core it removes. Unbind a core that is not the last one and the cor...

CVE-2026-99213: Linux: In the Linux kernel, the following vulnerability has been resolved: vsock: treat TCP_CLOSING as once-established Handle…

In the Linux kernel, the following vulnerability has been resolved: vsock: treat TCPCLOSING as once-established Handle the TCPESTABLISHED - TCPCLOSING transition on OPRST, which can race with the connect loop. Immediately break and return 0 on ESTABLISHED/CLOSING. The return value of connect shou...

PT-2026-128190

In the Linux kernel, the following vulnerability has been resolved: net: mv643xx: move setting of netops to fix crash mv643xx eth probe connects the PHY before dev-netdev ops is assigned. phy attach direct - phy link topo add phy reads dev-netdev ops through netdev need ops lock since the commit ...

PT-2026-128176

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when looking up a scheduler sched to core walks rdev-cores up to rdev-num cores, and rocket remove decrements num cores for every core it removes. Unbind a core that is not the last one and th...

PT-2026-128181

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac1000: clear the RGMII status interrupt Since commit 2e2c878a3141 "net: stmmac: remove SGMII/RGMII/SMII interrupt handling" nothing on the RGMII path reads GMAC RGSMIIIS, so RGSMIIIS stays pending behind GMAC INT...

PT-2026-128163

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.13 Description An issue exists in the Linux kernel where a task with root privileges in its own user namespace can bypass a locked cover on a file. This occurs because copy tree may leave out a mount of a mou...

PT-2026-128191

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: actions: Move setting of netops to fix crash owl emac probe calls owl emac phy init, which connects the PHY, before netdev-netdev ops is assigned. phy attach direct - phy link topo add phy reads dev-netdev ops...