PT-2026-72184

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211 gen new ie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The cod...

PT-2026-72176

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt When using WIFI out-of-band wakeup, an "irq xxx: nobody cared" warning occurs. This happens because the usdhc interrupt is not disabled during system...

PT-2026-72174

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTR TO TP BUFFER and PTR TO BUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...

PT-2026-72178

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: lpc32xx slc: fail DMA transfer on completion timeout lpc32xx xmit dma waits for the DMA completion callback but ignores wait for completion timeout. A timed out DMA transfer is therefore unmapped and reported as...

PT-2026-72462

In the Linux kernel, the following vulnerability has been resolved: fbdev: hecubafb: fix potential memory leak in hecubafb probe The memory allocated for pagerefs in fb deferred io init is not freed on the error path. Fix it by calling fb deferred io cleanup...

PT-2026-72173

In the Linux kernel, the following vulnerability has been resolved: device property: initialize the remaining fields of fwnode handle in fwnode init If a firmware node is allocated on the stack for instance: temporary software node whose life-time we control or on the heap - but using a non-zeroi...

PT-2026-72498

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2 ioctl query info validates the PASSTHRU FSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bound...

PT-2026-72407

In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm file leak when nlm do fopen fails A client can repeatedly drive nlm do fopen failures by presenting file handles that the underlying export rejects. After kzalloc obj succeeds in nlm lookup file, the freshly...

PT-2026-72177

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: fix esdhc change pinstate to allow default state restore esdhc change pinstate checks for pins 100mhz and pins 200mhz at the top of the function and returns -EINVAL if either is not defined. This prevents th...

PT-2026-72168

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect ueagle-atm uses the asynchronous request firmware nowait in .probe, but does not wait for its completion, not even in .disconnect; so, if the device is unplugged...

PT-2026-72238

In the Linux kernel, the following vulnerability has been resolved: ieee802154: admin-gate legacy LLSEC dump operations In net/ieee802154/netlink.c, the legacy IEEE802154 NL family ops table builds the LLSEC dump entries LLSEC LIST KEY, LLSEC LIST DEV, LLSEC LIST DEVKEY, LLSEC LIST SECLEVEL with...

PT-2026-72200

In the Linux kernel, the following vulnerability has been resolved: s390/diag: Add missing array index nospec call to memtop get page count 'level' is user space controlled and used to read from an array. Add the missing array index nospec call to prevent speculative execution...

PT-2026-72501

In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: Only consider active CRTCs for vblank sync Only synchronize fbdev output to the vblank of an active CRTC. Go over the list of CRTCs and pick the first that matches. Fixes warnings as the one shown below 77.201354...

PT-2026-72500

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix VF bringup affecting PF promiscuous state Mbox handling of nix set rx mode for a VF with promiscuous and all multi flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs...

PT-2026-72479

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix unlikely race in try get locked pte Fix an unlikely race in try get locked pte, which could have happened if puds or pmds get unmapped between the p?dp get and p?d offset functions...

PT-2026-72172

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential deadlock in f2fs balance fs When the f2fs filesystem space is nearly exhausted, we encounter deadlock issues as below: INFO: task A:1890 blocked for more than 120 seconds. Tainted: G O 6.12.41-g3fe07ddf05ab 1...

PT-2026-72233

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix stack buffer overflow in multichannel session-key copy Commit 4b706360ffb7 "ksmbd: fix multichannel binding and enforce channel limit" moved the binding-path session key out of the session-wide sess-sess key CIFS KEY...

PT-2026-72237

In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix cas ctl leak on spi async failure ca8210 spi transfer allocates cas ctl with kzalloc objGFP ATOMIC and relies entirely on the SPI completion callback ca8210 spi transfer complete to free it. The spi async...

PT-2026-72199

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: rebind mm mempolicy to effective mems, not mems allowed Creating a child cpuset where cpuset.mems is never set leads to a div/0 when a VMA mempolicy with MPOL F RELATIVE NODES rebinds in response to a CPU hotplug...

PT-2026-72269

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix use-after-free during unmount During unmount or failure teardown all mon data structures that contain monitoring event file private data are freed after which kernfs nodes are removed. However, the RDT DELETED fla...