PT-2026-79715

In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AF XDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the...

PT-2026-79736

In the Linux kernel, the following vulnerability has been resolved: sched ext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scx link sched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs...

PT-2026-79640

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit cursor bit cursor fetches the glyph under the cursor with c = scr readwvc pos; src = vc font.data + c & charmask w height; where charmask is 0x1ff when vc hi font mask is set. The...

PT-2026-79688

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdev get mask cnt and client evmasks arra...

PT-2026-79697

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smc listen out and listener close smc listen out reads lsmc-sk.sk state without the listener lock, then acquires lock sock nested only after the check passes. This opens a window where smc close...

PT-2026-79719

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpf iter tcp established batch reqsk queue hash req publishes a TCP NEW SYN RECV request sock onto the ehash chain, drops the bucket lock, and only afterwards sets rsk refcnt to 3. Lockless readers...

Linux Distros Unpatched Vulnerability : CVE-2026-74632

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/hugememory: fix hugezeropfn race Patch series mm/hugememory: fix hugezeropfn race, v2. There is a subtle race in the reference-counted hugezerofolio...

PT-2026-79703

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix BQL reset on SQ re-activation mlx5e queue start deactivates and re-activates all channels but closes only the queue being restarted. mlx5e activate txqsq then unconditionally calls netdev tx reset queue, zeroing th...

PT-2026-79717

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in create direct keys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmd exec+0x550/0xca0 mlx5 core Read of size 272 at addr 0000000176795020 by task...

PT-2026-79705

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls api: Always acquire rtnl lock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tc new tfilter where a tcf proto can be found and briefly referenced by a totally...

PT-2026-79657

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...

PT-2026-79722

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw tracer, return NULL on create error Tracer creation can fail by returning either NULL or ERR PTR. The return value is stored without a check on the device, and users treat ERR PTR and NULL the same way. This also...

PT-2026-79651

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, wait for completion interruptible returns -ERESTARTSYS and fastrpc internal invoke moves every buffer from fl-mmaps on...

PT-2026-79677

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire init mm lock on huge vmap to avoid ptdump UAF Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable freeing", v6. Kernel page table walkers fall into two broad categories - those ranges wher...

PT-2026-79667

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the inet frag create function where the fragment queue timer is armed before the queue is inserted into the fqdir rhashtable. If the namespace fragment timeout is zero...

PT-2026-79606

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Use current context for safe per-CPU buffer swap The ring buffer swap cpu function currently checks the per-CPU committing counter to determine if a buffer is actively being written to before performing the swap...

PT-2026-79738

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953x irq bus sync unlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2c lock. The functio...

PT-2026-79680

In the Linux kernel, the following vulnerability has been resolved: vt: stabilize tty reference in kbd keycode with tty port tty get kbd keycode reads vc-port.tty without acquiring a tty reference, racing against con shutdown which clears port.tty under a different lock. Use tty port tty get/tty...

PT-2026-79721

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix locally exploitable BUG ON in amdxdna insert pages In amdxdna insert pages, vm flags mod sets VM MIXEDMAP and clears VM PFNMAP. If an unprivileged userspace process mmaps a non-imported GEM object and then call...

PT-2026-79707

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhost scsi setup vq cmds runs from VHOST SCSI SET ENDPOINT and allocates each command's protection scatterlist array prot sgl according to the acknowledged VIRTIO SCSI F T10 PI bi...