A read-after-free memory flaw was found in the Linux kernel's garbage collection

A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close and fget simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on...

PT-2026-106694

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mr check range leading to OOB access mr check range validates that iova, iova+length falls within the registered MR range using wraparound-prone arithmetic: if iova ibmr.iova || iova + length...

PT-2026-106495

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulk move range ttm tt swapout returns the number of pages swapped out on success and a negative error code on failure; for a populated ttm it never returns zero. Commit...

PT-2026-106697

In the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutating skb frags On the out-of-place output path esp-inplace == false ESP rewrites the skb frag array: esp output head appends a trailer frag and esp output tail replaces the frags...

PT-2026-106683

In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Fix receive buffer leak when PKey enforcement fails ib mad complete recv initializes mad recv wc-rmpp list and then runs ib mad enforce security before linking recv buf onto that list. On failure it calls ib free recv...

PT-2026-106554

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: fix bogus set shrinker bit with cgroup.memory=nokmem With cgroup.memory=nokmem, shrinker memcg alloc bails out early and never allocates an id, so shrinker-id keeps the 0 it got from the kzalloc in shrinker alloc. li...

PT-2026-106699

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrm state netlink builds the ALLOCSPI response with dump one state, which already calls alloc compat with the response skb and header. xfrm alloc userspi then calls alloc compat...

PT-2026-106508

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix rmmio iounmap skipped on device removal amdgpu pci remove calls drm dev unplug before fini sw, so drm dev enter is already false there and the iounmap guarded by it is skipped. This .remove path runs on both...

PT-2026-106517

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate curve data length in the calibration curve converters p54 convert rev0 and p54 convert rev1 read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken...

PT-2026-106541

In the Linux kernel, the following vulnerability has been resolved: mmc: hsq: Fix use-after-free in retry work mmc hsq pump requests queues retry work when request atomic returns -EBUSY; today sdhci-sprd is the only consumer that implements request atomic. The work is embedded in a devm-allocated...

PT-2026-106560

In the Linux kernel, the following vulnerability has been resolved: xfrm: serialize state GC with device state flush The deferred-device pass in xfrm dev state flush finds states under xfrm state dev gc lock, but drops the lock before calling xfrm dev state free because the driver callback may...

Ubuntu 22.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-8871-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8871-1 advisory. It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the...

PT-2026-106515

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length mwifiex search oui in ie reads a pairwise-cipher PTK count from a beacon/probe-response RSN or WPA information element and then walks that many 4-byte OUIs,...

PT-2026-106620

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel pcie: fix off-by-one bounds check in RX submit btintel pcie submit rx used frbd index rxq-count to guard the FRBD array access, allowing frbd index == rxq-count to pass through and index one element past the en...

PT-2026-106537

In the Linux kernel, the following vulnerability has been resolved: mmc: sdio uart: fix xmit fifo leak when the port table is full sdio uart add port allocates the transmit fifo before claiming a slot in sdio uart table. When all UART NR slots are taken, it returns -EBUSY with the fifo still...

PT-2026-106556

In the Linux kernel, the following vulnerability has been resolved: memstick: ms block: destroy io queue workqueue on removal msb init disk creates the per-card ordered workqueue msb-io queue with alloc ordered workqueue. It is torn down with destroy workqueue only on the init error path; msb...

PT-2026-106698

In the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcu read lock, skb dst force and dev hold for xfrm trans reinject syzbot reported a suspicious RCU usage warning in ip6 pkt drop: WARNING: suspicious RCU usage in ip6 pkt drop include/net/addrconf.h:389 suspicio...

PT-2026-106700

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix runt reassembly panic from short inner tot len When the start of an inner packet is split across two outer packets such that fewer than 4 bytes land at the end of the first one, input process payload saves those...

PT-2026-106701

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfs skb reset frag walk iptfs skb reset frag walk advances to the fragment containing @offset with an unbounded loop: while offset = walk-past + walk-fragswalk-fragi.len walk-past +=...

PT-2026-106562

In the Linux kernel, the following vulnerability has been resolved: net/packet: clear RX owner on VNET header error Commit 61fad6816fc1 "net/packet: tpacket rcv: avoid a producer race condition" added rx owner map and made tpacket rcv claim a V1 or V2 ring slot before converting the virtio-net...