PT-2026-64759

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the Samsung serial driver when console flow control is enabled via UPF CONS FLOW. The issue arises because the functions s3c24xx serial stop tx and s3c24xx serial...

PT-2026-64739

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access occurs in the tcp ao established key function when it is called from tcp v46 timewait ack using a twsk TCP time-wait socket. This happens because the lockdep sock...

PT-2026-64738

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the error path of the xe gsc init post hwconfig function. The function explicitly frees a Buffer Object BO allocated with xe managed bo create pin map using...

PT-2026-64516

In the Linux kernel, the following vulnerability has been resolved: mm: page ext: add count limit to page ext iter next to prevent invalid PFN access The page ext iteration API does not validate if the PFN still belongs to a valid section while advancing the iterator. When dynamically adding memo...

PT-2026-64481

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the fuse-uring component. The fuse uring commit fetch function fails to check the queue-stopped value under a lock, and the fuse uring abort end requests...

PT-2026-64713

In the Linux kernel, the following vulnerability has been resolved: iio: temperature: tmp006: use devm iio trigger register tmp006 probe allocates the DRDY trigger with devm iio trigger alloc but registers it with plain iio trigger register. The driver has no .remove callback, so on module unload...

PT-2026-64718

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Include linux/bitfield.h for FIELD GET. Create new macros for bit manipulation in combination with manual bit manipulation being replaced with FIELD GET. Th...

PT-2026-64482

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the fuse-uring component. The function fuse uring async stop queues may execute after the final reference on the ring-queue refs variable has been droppe...

PT-2026-64565

In the Linux kernel, the following vulnerability has been resolved: USB: idmouse: fix use-after-free on disconnect race mutex unlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a...

PT-2026-64521

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the map range function where it accesses rb-aux pages, rb-aux nr pages, and rb-aux pgoff via perf mmap to page while holding only the event-mmap mutex. Because these...

PT-2026-64589

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the slab memory allocator where the zeroing process during allocation is incorrectly limited when only red zoning is enabled. When kmalloc is used with a request for...

PT-2026-64661

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HT caps handler HT caps handler iterates pIE-length bytes and writes into HT caps.u.HT cap, which is a fixed 26-byte array sizeof struct HT caps element. Because pIE-length is a raw u8 from an...

PT-2026-64557

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan pda: fix information leak The write callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspan pda implementation will however...

PT-2026-64553

In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is never freed on early ULPI device registration failures. Fix this by initialising the device structure earlier and releasing the initial reference...

PT-2026-64633

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module names must be null-terminated We need to explicitly check the length, else we may pass non-null terminated string to request module...

PT-2026-64525

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qat rsa setkey crt function where DMA buffers are allocated at half the key size key sz / 2. The function right-aligns CRT components p, q, dp, dq, qinv using...

PT-2026-64646

In the Linux kernel, the following vulnerability has been resolved: io uring/io-wq: re-check IO WQ BIT EXIT for each linked work item commit 10dc95939817 "io uring/io-wq: check IO WQ BIT EXIT inside work run loop" fixed the obvious case where io worker handle work took one exit-bit snapshot befor...

PT-2026-64638

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinker debugfs add creates both "count" and "scan" debugfs files unconditionally. That assumes every shrinker implements both count objects and scan objects, which is not...

PT-2026-64600

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where the parse dacl function fails to mask the server-provided sub auth2 value from the NFS mode SID to 07777 when modefromsid is active. This value is...

PT-2026-64611

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd module where byte-range locks are not correctly tracked across connections. When using SMB3 multichannel, the connection that handles a SMB2 LOCK request may...