PT-2026-116659

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvm arch flush shadow all, which is a Bad Ideatm. Freeing the page tables is fair game this is what this callback is...

PT-2026-116670

In the Linux kernel, the following vulnerability has been resolved: smb: client: use finish no open for non-regular inodes An O CREAT open can find an existing symlink or another non-regular inode. cifs atomic open calls finish open on it and attaches a cifsFileInfo. Symlink inodes have no CIFS...

PT-2026-117020

In the Linux kernel, the following vulnerability has been resolved: net: restrict SO RESERVE MEM to TCP sockets and cap max value Commit 2bb2f5fb21b0 "net: add new socket option SO RESERVE MEM" and commit d00c8ee31729 "net: fix possible NULL deref in sock reserve memory" only checked sk has...

PT-2026-116987

In the Linux kernel, the following vulnerability has been resolved: usb: typec: anx7411 - stop the IRQ before destroying the workqueue The IRQ is devm-managed, so it can still queue plat-work while remove is tearing the queue down. Disable it first...

PT-2026-116663

In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfs qm flush one fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is...

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2024:1719932549)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2024:1719932549 advisory. - In parsehidreportdescriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an H...

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2025:1742471200)

"The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2025:1742471200 advisory. - In the Linux kernel, the following vulnerability has been resolved: tun: avoid double free in tunfreenetdev Avoid double free in...

PT-2026-116672

In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2 open accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2 parse contexts rejects malformed context data, SMB2 open...

PT-2026-116707

In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on out-of-range hw next to clean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpd cons read": the hardware can report an out-of-range hw ne...

PT-2026-116764

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and ata scsi set passthru sense fields trusts it...

PT-2026-116785

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist reconstruction requests The firmware reconstruction count controls accesses to the request's fixed freelist ID array and the copy into the fixed response array. Neither access currently bounds the...

PT-2026-116790

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: clear stale buf-page after recycling on skb build failure In stmmac rx, when napi build skb fails the descriptor page is recycled back to the page pool with page pool recycle direct, but buf-page is left pointing at...

PT-2026-116795

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfc llcp wks sap and nfc llcp build sdreq tlv pass non-null- terminated strings to pr debug using the %s format specifier. The buffers are allocated via kmemdup o...

PT-2026-116681

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci conn: fix CIS hold ownership on reuse Commit 69997d50ec57 "Bluetooth: ISO: handle bound CIS cleanup via hci conn" made hci bind cis and hci connect cis return a connection with one hold for the ISO layer. hci bind...

PT-2026-116687

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix spurious warning for benign stage 2 teardown race kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an L2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB of RAM, all ...

PT-2026-116691

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Free have run cpus during VM destruction even if VM is no longer SEV Unconditionally free SEV's "have run CPUs" cpumask in the VM destroy path, i.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV...

PT-2026-116695

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccw device get util str The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpid to chp can retu...

PT-2026-116702

In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfc get local general bytes Commit 6709d4b7bc2e "net: nfc: Fix use-after-free caused by nfc llcp find local" attempted to fix a use-after-free UAF issue by invoking nfc llcp local putlocal after accessi...

PT-2026-116723

In the Linux kernel, the following vulnerability has been resolved: PCI: of property: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

PT-2026-116735

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1a ram new pci get domain bus and slot takes a reference to the PCI device, which is never released once the memory size has been read from its config space. Drop the reference before...