PT-2026-106535

In the Linux kernel, the following vulnerability has been resolved: Input: cyttsp5 - clamp the HID report size before memcpy The size field comes from the device and is used as the memcpy length into response buf, which is CY MAX INPUT bytes...

ROS-20261006-73-0001

The vulnerability of the mcp251xopen function in the drivers/net/can/spi/mcp251x.c file of the Linux kernel’s CAN network device driver is related to the creation of critical data packets. Exploiting this vulnerability could allow an attacker to cause a system failure...

PT-2026-106521

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xx dxe deinit tears down the TX ack timer with timer delete, which only dequeues the timer and does not wait for a callback that is already executing; the...

Linux Distros Unpatched Vulnerability : CVE-2026-98241

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: xfrm: use full sockets in local error paths xfrm6localrxpmtu and xfrm6localerror dereference skb-sk as if it always pointed at a full IPv6 socket. That is...

PT-2026-106694

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mr check range leading to OOB access mr check range validates that iova, iova+length falls within the registered MR range using wraparound-prone arithmetic: if iova ibmr.iova || iova + length...

PT-2026-106684

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: guard against null kobj name In the client, if init path errors, the callee tries to clean up with rtrs clt close conns. However, this can lead to calling the event tracing code with clt path-kobj-name being NULL and...

PT-2026-106511

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: refuse to make a monitor active when it has no queue A monitor interface only gets a TXQ if it's created active, and one can't be added later. Setting the flag on a down interface is still allowed, so the driver i...

PT-2026-106608

In the Linux kernel, the following vulnerability has been resolved: btrfs: handle lack of space when cleaning up verity items When enable verity hits the qgroup limit, rollback verity needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole...

PT-2026-106657

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scan ies len. Otherwise, building probe request...

PT-2026-106495

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulk move range ttm tt swapout returns the number of pages swapped out on success and a negative error code on failure; for a populated ttm it never returns zero. Commit...

PT-2026-106697

In the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutating skb frags On the out-of-place output path esp-inplace == false ESP rewrites the skb frag array: esp output head appends a trailer frag and esp output tail replaces the frags...

PT-2026-106683

In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Fix receive buffer leak when PKey enforcement fails ib mad complete recv initializes mad recv wc-rmpp list and then runs ib mad enforce security before linking recv buf onto that list. On failure it calls ib free recv...

PT-2026-106554

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: fix bogus set shrinker bit with cgroup.memory=nokmem With cgroup.memory=nokmem, shrinker memcg alloc bails out early and never allocates an id, so shrinker-id keeps the 0 it got from the kzalloc in shrinker alloc. li...

PT-2026-106515

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length mwifiex search oui in ie reads a pairwise-cipher PTK count from a beacon/probe-response RSN or WPA information element and then walks that many 4-byte OUIs,...

PT-2026-106699

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrm state netlink builds the ALLOCSPI response with dump one state, which already calls alloc compat with the response skb and header. xfrm alloc userspi then calls alloc compat...

PT-2026-106508

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix rmmio iounmap skipped on device removal amdgpu pci remove calls drm dev unplug before fini sw, so drm dev enter is already false there and the iounmap guarded by it is skipped. This .remove path runs on both...

PT-2026-106517

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate curve data length in the calibration curve converters p54 convert rev0 and p54 convert rev1 read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken...

PT-2026-106541

In the Linux kernel, the following vulnerability has been resolved: mmc: hsq: Fix use-after-free in retry work mmc hsq pump requests queues retry work when request atomic returns -EBUSY; today sdhci-sprd is the only consumer that implements request atomic. The work is embedded in a devm-allocated...

PT-2026-106560

In the Linux kernel, the following vulnerability has been resolved: xfrm: serialize state GC with device state flush The deferred-device pass in xfrm dev state flush finds states under xfrm state dev gc lock, but drops the lock before calling xfrm dev state free because the driver callback may...

Ubuntu 22.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-8871-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8871-1 advisory. It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the...