PT-2026-116790

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: clear stale buf-page after recycling on skb build failure In stmmac rx, when napi build skb fails the descriptor page is recycled back to the page pool with page pool recycle direct, but buf-page is left pointing at...

PT-2026-116795

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfc llcp wks sap and nfc llcp build sdreq tlv pass non-null- terminated strings to pr debug using the %s format specifier. The buffers are allocated via kmemdup o...

PT-2026-116681

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci conn: fix CIS hold ownership on reuse Commit 69997d50ec57 "Bluetooth: ISO: handle bound CIS cleanup via hci conn" made hci bind cis and hci connect cis return a connection with one hold for the ISO layer. hci bind...

PT-2026-116687

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix spurious warning for benign stage 2 teardown race kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an L2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB of RAM, all ...

PT-2026-116691

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Free have run cpus during VM destruction even if VM is no longer SEV Unconditionally free SEV's "have run CPUs" cpumask in the VM destroy path, i.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV...

PT-2026-116695

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccw device get util str The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpid to chp can retu...

PT-2026-116702

In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfc get local general bytes Commit 6709d4b7bc2e "net: nfc: Fix use-after-free caused by nfc llcp find local" attempted to fix a use-after-free UAF issue by invoking nfc llcp local putlocal after accessi...

PT-2026-116723

In the Linux kernel, the following vulnerability has been resolved: PCI: of property: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

PT-2026-116735

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1a ram new pci get domain bus and slot takes a reference to the PCI device, which is never released once the memory size has been read from its config space. Drop the reference before...

PT-2026-116738

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix runtime PM leak in amdgpu debugfs test ib show amdgpu debugfs test ib show resumes the device with pm runtime get sync before taking the reset domain semaphore with down write killable. If the write lock acquisiti...

PT-2026-116740

In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix incorrect RCU teardown order i915 gem busy ioctl uses dma resv for each fence unlocked to iterate over the fences in an GEM object without holding a reference but only the RCU read side lock. What can happen here is...

PT-2026-116741

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvr mmu map sgl Map failure from pvr mmu map sgl interface was not returned correctly to pvr mmu map interface. This resulted in pvr mmu map interface to continue instead of...

PT-2026-116743

In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rds ib map frmr stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, rds rdma map unpins the pages and frees the scatterlist, but...

PT-2026-116757

In the Linux kernel, the following vulnerability has been resolved: writeback: bound cleanup offline cgwb rescans by rotating scanned inodes cleanup offline cgwb prepares at most WB MAX INODES PER ISW inodes per call and is called again until the dying wb is drained, but every call walks wb-b...

PT-2026-116778

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on lgr list traversal in smcr port err smcr port err traverses smc lgr list.list without holding smc lgr list.lock, allowing a concurrent smc lgr terminate sched to free an lgr while it is still being dereference...

PT-2026-116806

In the Linux kernel, the following vulnerability has been resolved: firewire: cdev: fix back-transition for iso resource auto client resource The todo member of iso resource auto structure represents the state of the client resource and normally transitions in the following order: ISO RES AUTO...

PT-2026-116807

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject max entries INT MAX in sock map alloc sock map alloc only rejects max entries == 0 and otherwise allows any u32 value. sock map free then walks the sks array with a signed int iterator: int i; for i = 0; i...

PT-2026-117083

In the Linux kernel, the following vulnerability has been resolved: sched ext: Wait for SCX OPSS DISPATCHING before reenqueueing a task ebf1ccff79c4 "sched ext: Fix ops.dequeue semantics" moved the final ops state store in scx dispatch enqueue after the DSQ unlock so that the custody update and...

PT-2026-117086

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory cache key decode takes a key's logical off from the cache device and later indexes req key tree-subtrees by it in get subtree. An off past the device forms a subtree...

PT-2026-116733

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validate init On the ttm bo reserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drm gem objec...