PT-2026-72744

In the Linux kernel, the following vulnerability has been resolved: ext4: fix kernel BUG in ext4 write inline data end When the data=journal mount option is used, the ext4 journalled write end function incorrectly calls ext4 write inline data end without checking if the EXT4 STATE MAY INLINE DATA...

PT-2026-72606

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conncount: prevent connlimit drops for early confirmed ct Commit 69894e5b4c5e "netfilter: nft connlimit: update the count if add was skipped" introduced a regression where packets for valid connections are dropped...

PT-2026-72733

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix undefined shift of user RQ WQE size set rq size computes the RQ WQE size as "1 rq wqe shift" based on the user-provided rq wqe shift, which is only checked to be greater than 32, so shifts of 32 are still accepted....

PT-2026-72443

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf queue: pin bridge device while NFQUEUE holds fake dst The br netfilter fake rtable is embedded in struct net bridge and is attached to bridged packets with skb dst set noref. If such a packet is queued to NFQUEUE, n...

PT-2026-72442

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft fib: reject fib expression on the netdev egress hook A fib expression in a netdev egress base chain dereferences nft inpkt, NULL on the transmit path, causing a NULL pointer dereference at eval. nft fib validate...

PT-2026-72454

In the Linux kernel, the following vulnerability has been resolved: fbdev: vesafb: fix memory leak in vesafb probe Since commit 73ce73c30ba9 "fbdev: Transfer video= option strings to caller; clarify ownership" the string returned from fb get options is expected to be freed by the caller. But the...

PT-2026-72359

In the Linux kernel, the following vulnerability has been resolved: mtd: slram: remove failed entries from the device list register device links a new slram mtdlist entry before allocating all of the state needed by the entry. If a later allocation, memremap, or mtd device register fails, the...

PT-2026-72356

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix fault in unaligned fixup Use kzalloc obj / kzalloc objs to allocate the memcard structs, instead of kmalloc obj / kmalloc objs to prevent access to uninitialized data. Fixes runtime error: Fault in...

PT-2026-72291

In the Linux kernel, the following vulnerability has been resolved: dm early create: fix freeing used table on dm resume failure If dm resume fails, the kernel attempts to free table with dm table destroy, but the table was already instantiated with dm swap table. This commit skips the call to dm...

PT-2026-72341

In the Linux kernel, the following vulnerability has been resolved: irqchip/crossbar: Use correct index in crossbar domain free crossbar domain free resets the domain data and then uses the nulled out irq data-hwirq member as index to reset the irq map entry and to write the relevant crossbar...

PT-2026-72343

In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: swp: Improve locking user experience In the case of the first block being locked or the few first blocks, if the user want to fully unlock the device it has two possibilities: - either it asks to unlock the entire...

PT-2026-72344

In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero header size OOB read in mpf ops parse header mpf ops parse header reads header size from the bitstream at MPF HEADER SIZE OFFSET 24. When header size is zero, the expression buf + header size - 1 rea...

PT-2026-72673

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresight add out conn increments nr outconns before calling devm krealloc array and again before devm kmalloc. If either allocation fails, the counter ...

PT-2026-72657

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDR CHANGE rpcrdma cm event handler falls through to the disconnected: label on RDMA CM EVENT ADDR CHANGE and calls rpcrdma ep put with no matching get when the event arrives before RDMA CM EVE...

PT-2026-72653

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The out norqst exit in rpcrdma reply handler branches away before the credit clamp, so a reply that matches no pending request reaches out post carrying the raw credit value...

PT-2026-72526

In the Linux kernel, the following vulnerability has been resolved: net/sched: act pedit: fix TOCTOU heap OOB write in tc offload There is a TOCTOU race condition in flower lockless approach between sizing a flow rule buffer and filling it. [email protected] reports: The cls flower...

PT-2026-72570

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parse dacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

PT-2026-72554

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs create write req to handle async cache object creation netfs create write req will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far...

PT-2026-72279

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdna drm sync bo ioctl looks up args-handle in the ioctl caller's drm file. For SYNC DIRECT FROM DEVICE, it then calls amdxdna hwctx sync debug bo, but passes abo-client...

PT-2026-72327

In the Linux kernel, the following vulnerability has been resolved: tcp: defer md5sig info kfree past RCU grace period in tcp connect The md5+ao reconciliation in tcp connect net/ipv4/tcp output.c has two symmetric branches: if needs md5 tcp ao destroy socksk, false; else if needs ao tcp clear md...