PT-2026-116658

In the Linux kernel, the following vulnerability has been resolved: smb/server: cancel async requests when closing connection An async request may still be waiting when a connection is closed. This can stop the connection from closing. Cancel active async requests before waiting for them to finis...

PT-2026-116722

In the Linux kernel, the following vulnerability has been resolved: packet: use ubuf info completion for TX RING packets tpacket snd sends skbs with frags pointing into its ring slots. Slots are released when skb-destructor is called. A call to skb orphan calls skb-destructor before the skb is...

PT-2026-116758

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: use d instantiate new in ntfs create inode and murder syzbot's "WARNING in do new mount" saga ntfs create inode creates a new inode via ntfs new inode. It hashes it with insert inode locked and so it's marked as I NEW...

PT-2026-116729

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xe vm close and put, external-BO VMAs are queued on the contested list for deferred destruction via xe vma destroy unlocked. However, xe vm pt destroy was previously...

PT-2026-116727

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtio gpu fence alloc can fail due to memory pressure and return NULL, but its caller like virtio gpu init submit never checks it. Later, virtio gpu init submi...

PT-2026-116744

In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag list in mctp lookup prealloc tag When a socket transmits a packet with MCTP TAG PREALLOC set, mctp lookup prealloc tag iterates over the per-netns &mns-keys list and matches netid, req tag, peer...

PT-2026-116818

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stack slot obj get spi bpf get spi computes -off - 1 / BPF REG SIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot...

PT-2026-116763

In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnad pci remove and the probe disable ioceth path call timer delete sync for ioc timer, sem timer and hb timer, but not for iocpf timer. bn...

PT-2026-116721

In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alps input configured allocates a second input device "DualPoint Stick" with input allocate device and registers it, but the alps driver struct has no .remove handler a...

PT-2026-116815

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6 route output flags, ip6 rt put flags, and ip6 dst check detect an uncached route by list empty&rt-dst.rt uncached, which replaced the static DST NOCACHE flag check in commit a4c2fd7f789...

PT-2026-116656

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: fix runtime PM reference leaks Use pm runtime resume and get in iris enable power domains to avoid leaking a runtime PM usage count on failure. Also ensure pm runtime put sync is always called in iris disable...

PT-2026-116667

In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM points out that we leak the igrab'd reference to the orphanage directory inode if chowning it fails. Fix that...

PT-2026-116678

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hci bind bis hci conn link takes a lifetime reference to its parent with hci conn get, but only takes an operational hold on the child. hci conn unlink later balances both a hold and a...

PT-2026-116701

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfc llcp recv hdlc nfc llcp recv hdlc reads the sequence byte skb-data2, via nfc llcp ns/nfc llcp nr, before any length check. The receive path only guarantees the two-byte LLCP header -...

PT-2026-116736

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveau uvmm sm when BO is in TTM PL SYSTEM nouveau uvmm sm calls op map, which passes bo-resource through nouveau mem to nouveau uvma map. nouveau uvmm vmm map then reads mem-mem.type. But this is on...

PT-2026-116809

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf sock context code generation Currently, the ctx access code reads the rx queue mapping field with either a 4-byte or 2-byte load. The rest of the bits in the register are marked known zero by the verifier. However, t...

PT-2026-116819

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm recv frame While rfcomm recv frame verifies that skb-len is at least sizeofhdr + 1 4 bytes: 3-byte header + 1-byte FCS, an RFCOMM frame with an extended 2-byte length field !...

PT-2026-116682

In the Linux kernel, the following vulnerability has been resolved: sched ext: Derive SCX RQ IN WAKEUP from the core enqueue flags schedule deferred locked skips scheduling a deferred action while SCX RQ IN WAKEUP is set and relies on the task woken scx call that follows a wakeup enqueue to run i...

PT-2026-116688

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix AArch32 DBGBXVR handling The consolidation of the breakpoint and watchpoint register accessors switched DBGBXVR from trap bvr to trap dbg wb reg. The latter selects backing storage with demux wb reg, which only...

PT-2026-116698

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi tcp: Check the data direction of a Data-In PDU The Data-In branch of iscsi tcp hdr dissect resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the...