PT-2026-72841

In the Linux kernel, the following vulnerability has been resolved: OPP: Fix race between OPP addition and lookup A race exists between dev pm opp add dynamic and dev pm opp find freq exact: CPU0 add CPU1 lookup ------------------------------- ------------------------------ opp add mutex lock lis...

PT-2026-72809

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix bio accounting for split md cloned bios Use md cloned bio to control bio accounting instead of relying on r1bio existed in raid1 or the io accounting flag in raid10. The previous logic does not reliably refle...

PT-2026-72860

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vc data fbcon new modelist runs when a framebuffer's modelist changes. For each console mapped to it with fb displayi.mode set, it reads vc consi.d and passes the vc num t...

PT-2026-72956

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initialize timer A userspace-driven ALSA timer SND UTIMER lets an unprivileged user set the backing snd timer's hardware resolution to an arbitrary 64-bit value via SNDRV TIMER IOCTL CREATE. snd...

PT-2026-72943

In the Linux kernel, the following vulnerability has been resolved: of/address: Fix NULL bus dereference in of pci range parser one The bus matching rework made of match bus return NULL for nodes with ranges/dma-ranges but no local address-cells. parser init stored that NULL bus, and the range...

PT-2026-72950

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill max is set When a USB audio endpoint requests full packet transfers via the fill max descriptor flag, data ep set params promotes ep-curpacksize to ep-maxpacksize...

PT-2026-72942

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid use-after-free in poll trace queue dumps TIPC socket tracepoints dump queue state through tipc sk dump. Most queue-dump callsites already serialize that walk under the socket lock or sk-sk lock.slock, but tipc poll...

PT-2026-72949

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode snd usb handle sync urb scales received sync packet sizes by the sender's stride and stores the result directly in out packet-packet sizei. If a connected USB device sen...

PT-2026-72968

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if L2 is active and KVM is using a separate MSR bitmap to run L2. If AVIC is...

PT-2026-72978

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix potential deadlock in mpi3mr fault uevent emit mpi3mr fault uevent emit runs from the fault watchdog and reset paths where host I/O may already be blocked. GFP KERNEL allocations here, both the local kzalloc obj...

PT-2026-72276

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfc sli4 driver resource setup The memory allocated for mboxq using mempool alloc is not freed in some of the early exit error paths. Fix that by moving the mempool free call to an earlier point...

PT-2026-72308

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcm tx lock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there, mirroring the approach already used in bcm rx setup. Only copy the...

PT-2026-72654

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounded peek rpcrdma is bcall decodes a reply's first words to decide whether the frame is a backchannel call. Two issues in that decode path let a short or malformed reply leak the receive buff...

PT-2026-72682

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Replace waitqueue and flag with completion The driver previously used a waitqueue along with an explicit request done flag, but without proper barriers around request done. An earlier patch by Gui-Dong Han attempted t...

PT-2026-72676

In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdw add element group count found by syzkaller The original implementation caused an out-of-bounds memory access in the sdw add element group count for-loop when i == num. for i = 0; i ratesi && lane ==...

PT-2026-72688

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt re: Free SRQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt qplib destroy srq won't write the toggle values to an already-fre...

PT-2026-72730

In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: aiu: Validate written enum values The AIU HDMI and internal codec mux put callbacks use the written enum value with snd soc enum item to val before checking whether the value is valid for the enumeration. Reject...

PT-2026-72778

In the Linux kernel, the following vulnerability has been resolved: kernfs: link kn to its parent before the LSM init hook After commit 12e9e3cd03b5 "simpe xattr: use per-sb cache", kernfs xattr set and kernfs xattr get compute the cache via kernfs rootkn before any other check. kernfs rootkn wal...

PT-2026-72801

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

PT-2026-72804

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12k wifi7 dp rx h verify tkip mic In ath12k wifi7 dp rx h verify tkip mic, the call to ath12k dp rx check nwifi hdr len valid may return false when the NWIFI header length is invalid, causing t...