PT-2026-72802

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in change sta links for unready link ieee80211 set active links calls ieee80211 link use channel for each newly-added link and WARN ON ONCEs if it fails. The call uses assign on failure=true, which...

PT-2026-72808

In the Linux kernel, the following vulnerability has been resolved: raid1: fix nr pending leak in REQ ATOMIC bad-block error path In raid1 write request, each per-mirror loop iteration begins by incrementing rdev-nr pending. If a REQ ATOMIC write encounters a badblock within the requested range,...

PT-2026-72616

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack slot index in nospec checks check stack write fixed off computes the byte slot for a fixed-offset stack write as -off - 1, and records each written byte in slot type with slot - i % BPF REG SIZE. The Spectre v4...

PT-2026-72618

In the Linux kernel, the following vulnerability has been resolved: net/sched: act ct: fix nf connlabels leak on two error paths tcf ct fill params calls nf connlabels get setting put labels when TCA CT LABELS is present, but two later error sites use a bare return instead of "goto err", skipping...

PT-2026-72375

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid self-deadlock during inode eviction An attribute-list update performed while allocating clusters can drop the last reference to the temporary attribute inode. Evicting that inode drops its reference to the base inode...

PT-2026-72366

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: always put unsuccessfully committed target pids damon commit target puts and gets the destination and the source target pids. It puts the destination target pid because it will be overwritten by the source target...

PT-2026-72528

In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: fix races on the shared Super VCAP block The VCAP instances on a chip are not independent, yet they are locked independently. On sparx5 and lan969x the IS0 and IS2 instances are backed by the same Super VCAP...

PT-2026-72541

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in fallocate ntfs attr fallocate allocates holes and delayed allocations inside initialized size by looking up the current runlist element under ni-runlist.lock. The returned struct...

PT-2026-72549

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hw engine: Fix double-free of managed BO in error path The error path in hw engine init explicitly frees a BO allocated with xe managed bo create pin map via xe bo unpin map no vm. Since the managed BO already has a devm...

PT-2026-72533

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback On failure at index i, the reverse cleanup loop in mlx5 lag create single fdb starts from i, so the failed index itself is rolled back. That can operate on uninitialized...

PT-2026-72741

In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 "bpf: Fix oob access in cgroup local storage" is still incomplete. The prog-array compatibility check treats a program with no cgroup storag...

PT-2026-72241

In the Linux kernel, the following vulnerability has been resolved: net: ip6 gre: require CAP NET ADMIN in the device netns for changelink ip6gre changelink and ip6erspan changelink operate on at most two netns, dev netdev and the tunnel link netns t-net. They differ once the device is created in...

PT-2026-72297

In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consistency on commit failure reserve metadata snap and release metadata snap modify the superblock's held root directly in the block manager's buffer. If the subsequent metadata commit...

PT-2026-72298

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: unregister blocking notifier on init failure sparx5 register notifier blocks registers the switchdev blocking notifier before allocating the ordered workqueue. If the workqueue allocation fails, the error path...

PT-2026-72267

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - validate control endpoint type The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint...

PT-2026-72282

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix use-after-free in amdxdna gem dmabuf mmap When vm insert pages fails, the error path calls vma-vm ops-closevma which internally calls drm gem vm close → drm gem object put, releasing the GEM object reference...

PT-2026-72284

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Make dma fence dedup array robust against 0-count input dma fence dedup array returns 1 when called with num fences == 0: the for-loop body never executes, j stays at 0, and the final return ++j yields 1. This...

PT-2026-72265

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in ims pcu irq debug logging The debug logging in ims pcu irq unconditionally prints data from pcu-urb in buf. However, if the interrupt fired for pcu-urb ctrl, the actual data resides in...

PT-2026-72249

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups icssg ndo get stats64 unconditionally calls emac get stat by name with FW PA stat names regardless of whether the PA stats block is present on the hardware. emac get stat by name...

PT-2026-72845

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware mac id in link lookup The mac id field in RX descriptors is 8 bits wide 0-255, but assoc link on macid has only RTW89 MAX MAC ID NUM 128 entries. While the driver currently assigns mac id...