PT-2026-72518

In the Linux kernel, the following vulnerability has been resolved: net/tls: Consume empty data records in tls sw read sock A peer may send a zero-length TLS application data record; TLS 1.3 explicitly permits these as a traffic-analysis countermeasure RFC 8446, Section 5.1. After decryption such...

PT-2026-72833

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5 ib alloc transport domain allocates a transport domain and then may fail in mlx5 ib enable lb. In that case, the allocated TD is leaked. Fix this by...

PT-2026-72868

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix leak of released call in recvmsgMSG PEEK Fix rxrpc recvmsg to also drop the ref it holds on an already-released call if MSG PEEK is in force the function holds a ref on the call irrespective of whether MSG PEEK is...

PT-2026-72794

In the Linux kernel, the following vulnerability has been resolved: ext4: fix fast commit wait/wake bit mapping on 64-bit On 64-bit, ext4 dynamic inode states live in the upper half of i flags, and ext4 test inode state applies the corresponding +32 offset. The fast-commit wait and wake paths...

PT-2026-72861

In the Linux kernel, the following vulnerability has been resolved: afs: handle CB.InitCallBackState3 requests without a server record The cache manager callback path now attaches the server record to an incoming call through the rxrpc peer's app data. That association is not guaranteed to exist...

PT-2026-72818

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls bpf: prevent unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in cls bpf offload cmd. Reproducer on netdevsim: add a skip sw cls bpf filter, set the bpf tc accept debugfs knob to 0, then...

PT-2026-72791

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix RB-tree corruption in probe error path The info-node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the device rbtree insert call is skipped. If a subsequent probe step fails, th...

PT-2026-72811

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix deadlock in read error recovery path raid1d and raid10d may resubmit a split md cloned bio while handling a read error. In this case, resubmitting the bio can lead to a deadlock if the array is suspended befo...

PT-2026-72505

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpc clnt across the TLS connect worker The TLS connect path has a use-after-free: nothing pins the upper rpc clnt across the delayed connect worker. xs connect stores task-tk client in sock xprt::clnt as a raw...

PT-2026-72551

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio state after ENOMEM whilst under writeback iteration Fix the state of the current folio when ENOMEM occurs during writeback iteration. The folio needs to be redirtied and unlocked before the terminal writeback ite...

PT-2026-72514

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...

PT-2026-72516

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdna umap lifetime race amdxdna umap release calls the blocking mmu interval notifier remove before removing the object from abo-mem.umap list. If aie2 populate range runs concurrently, it may obta...

PT-2026-72857

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dw dp: Switch to drmm kzalloc Driver makes use of drmm encoder init to initialize the encoder and automatically handle the cleanup by registering drm encoder cleanup with drmm add action. However, the internal...

PT-2026-72569

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistent id race the fp-owner.name compare-read in ksmbd vfs compare durable owner against th...

PT-2026-72784

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: require a ref for locking state debugfs open debug lockres open copies inode-i private into struct debug lockres and debug lockres release later drops that pointer with dlm put. That only works if open successfully pin...

PT-2026-72684

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt re: Proper rollback if the ioremap fails bnxt qplib alloc dpi returns success even if ioremap fails. Add the proper rollback when the ioremap fails and return -ENOMEM status...

PT-2026-72681

In the Linux kernel, the following vulnerability has been resolved: net: serialize netif running check in enqueue to backlog Syzbot reported a KASAN slab-use-after-free in fib rules lookup. The root cause is a race condition where packets can escape the backlog flushing during device unregistrati...

PT-2026-72685

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt re: Add a max slot check for SQ The variable WQE mode must be validated against the maximum slots supported by HW. The max supported value is 64K. Adding a max and min check and fail if user supplied value is more than...

PT-2026-72707

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: fix supplied from allocations If dts property power-supplies has multiple values, then accessing to psy-supplied fromi-1 in power supply populate supplied from will overrun supplied from array...

PT-2026-72727

In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen checks before using them...