PT-2026-72458

In the Linux kernel, the following vulnerability has been resolved: fbdev: s3fb: fix potential memory leak in s3 pci probe In s3 pci probe, the memory allocated for modelist using fb videomode to modelist is not freed in subsequent error paths. Fix that by calling fb destroy modelist...

PT-2026-72444

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt cluster: reject template conntracks in hash match xt cluster mt treats any non-NULL nf ct get result as a fully initialized conntrack and passes it to xt cluster hash. This causes a state confusion bug when the raw...

PT-2026-72453

In the Linux kernel, the following vulnerability has been resolved: fbdev: nvidia: fix potential memory leak in nvidiafb probe In nvidiafb probe, the memory allocated for modelist in nvidia set fbinfo is not freed in the subsequent error paths. Fix that by calling fb destroy modelist...

PT-2026-72392

In the Linux kernel, the following vulnerability has been resolved: ntfs: centalize $INDEX ROOT header validation Add a dedicated helper to perform stricter validation of $INDEX ROOT and use it for both directory inodes and named index inodes. This keeps the root size and header geometry checks...

PT-2026-72377

In the Linux kernel, the following vulnerability has been resolved: ntfs: fail attrlist updates when the superblock is inactive generic shutdown super clears SB ACTIVE before evicting cached inodes. If eviction selects the fake inode for a base inode's unnamed $ATTRIBUTE LIST attribute, ntfs evic...

PT-2026-72373

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix WARN ON for resident attribute in ntfs map runlist nolock When ntfs map runlist nolock needs to look up the attribute extent containing a target VCN ctx needs reset == true, it calls ntfs attr lookup and then expects th...

PT-2026-72302

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing device refcount for CAN filter removal sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6...

PT-2026-72309

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu list annotations and operations sashiko-bot remarked the missing use of list add rcu in bcm rx|tx setup to have a proper initialized bcm op structure when bcm proc show traverses the bcm op's under rcu...

PT-2026-72350

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2 sum rightmost rec BUG On-disk corruption setting l next free rec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. CAUSE ocfs2 sum...

PT-2026-72346

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: add bounds check in dfh get param size dfh get param size can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP End of Parameters bit...

PT-2026-72386

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject non-resident records for resident-only attributes The shared lookup-time attribute validator rejects non-resident $FILE NAME and $VOLUME NAME records because their formats require resident values and callers handle...

PT-2026-72285

In the Linux kernel, the following vulnerability has been resolved: dm-verity: make error counter atomic The error counter "v-corrupted errs" was not atomic, thus it could be subject to race conditions. The call to dm audit log target"max-corrupted-errors" may be skipped due to the races...

PT-2026-72294

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitset size overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to region count overflow" made sure that region count could fit in an unsigned int. But the bitmap memory isn't allocat...

PT-2026-72329

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 IRQ SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next...

PT-2026-72396

In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfs ea lookup and ntfs listxattr, this verifies that there is enough space in the EA entry before accessing the next entry offset field of the EA entry...

PT-2026-72368

In the Linux kernel, the following vulnerability has been resolved: mm/huge memory: preserve pmd swp uffd wp on device-private PMD downgrade change non present huge pmd rewrites a writable device-private PMD swap entry into a readable one without carrying pmd swp uffd wp across. The PTE-level...

PT-2026-72299

In the Linux kernel, the following vulnerability has been resolved: bpf,fork: wipe -bpf storage before bailouts that access it Currently, copy process can bail out to free task before p-bpf storage has been initialized, with this call graph shown here for the !CONFIG MEMCG case: copy process dup...

PT-2026-72307

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN detected a data race within the bcm rx handler when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. Use atomic operations with...

PT-2026-72365

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: fix dir put orders in access pattern add dirs Patch series "mm/damon/sysfs-schemes: fix wrong directories put orders in error paths". Error paths of damon sysfs access pattern add dirs and damon sysfs sche...

PT-2026-72354

In the Linux kernel, the following vulnerability has been resolved: net/9p: fix infinite loop in p9 client rpc on fatal signal When p9 client rpc is called with type P9 TFLUSH and the transport has no peer e.g. fd transport backed by pipes with no 9p server, a fatal signal causes an infinite loop...