PT-2026-72171

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential deadlock in gc merge path of f2fs balance fs When we mount device w/ gc merge mount option, we may suffer below potential deadlock: Kworker GC trehad Truncator - f2fs write cache pages - f2fs write single data...

PT-2026-72263

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix type confusion in CDC union descriptor parsing The driver currently trusts the bMasterInterface0 from the CDC union descriptor without verifying that it matches the interface being probed. This could lead to...

PT-2026-72779

In the Linux kernel, the following vulnerability has been resolved: kernfs: fix xattr race condition with multiple superblocks Multiple superblocks with different namespaces can share the same kernfs node when kernfs test super finds a matching root but different namespace. This means multiple...

PT-2026-72547

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bo meminfo When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle...

PT-2026-72768

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-sof: Bound DAI link iteration create sdw dailinks walks sof dais until it finds an entry with initialised cleared, but sof dais is allocated with exactly num ends entries. If all entries are initialised, the lo...

PT-2026-72281

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit op amdxdna cmd submit calls xdna-dev info-ops-cmd submit unconditionally, but only aie2 dev ops defines that callback. aie4 vf ops the AIE4 SR-IOV virtual...

PT-2026-72497

In the Linux kernel, the following vulnerability has been resolved: tracing/remotes: Fix leak in trace remote alloc buffer error path If page allocation fails in trace remote alloc buffer, desc-nr cpus is not yet incremented for the current CPU. As a consequence, on error, half-allocated rb desc...

PT-2026-72232

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix missing dirty page tracking in pte,pmd wrprotect When hardware page table walker PTW is enabled on LoongArch, the CPU may set PAGE DIRTY directly in the page table entry during a write TLB miss, without going throu...

PT-2026-72471

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Nullify irqfd-producer if updating IRTE for bypass fails Nullify irqfd-producer if updating the IRTE for bypass fails, as leaving a dangling pointer will result in a use-after-free if the irqfd is reachable through KVM'...

PT-2026-72270

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix I/O leak on unsupported additional CDB efct dispatch fcp cmd allocates an efct io before dispatching an unsolicited FCP command. If the command has an unsupported additional CDB, the function returns -EIO...

PT-2026-72468

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Drop bogus WARN for write to ZCR EL2 It is entirely possible for a guest to write to the ZCR EL2 sysreg alias while in a nested context, as it is expected if FEAT NV2 is advertised to the L1 hypervisor. Get rid of...

PT-2026-72556

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double unlock in nomem d alloc error path When start creating fails and returns -ENOMEM, it has already released the parent directory lock in start dirop: static struct dentry start dirop... ... inode lock...

PT-2026-72694

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard get user acesss with access ok for uprobe multi data As reported by sashiko 1 we need to use access ok to check the user space data bounds before we use get-user to get it. 1...

PT-2026-72692

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpf msg pop data bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l ||...

PT-2026-72465

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the...

PT-2026-72393

In the Linux kernel, the following vulnerability has been resolved: ntfs: free volume-wide resources on fill super failure ntfs fill super's err out now path frees only the volume struct via kfreevol, leaving several vol-owned allocations behind on every mount failure: - vol-nls map, loaded by nt...

PT-2026-72521

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix tx ident leak for commands without a response Commit 6c3ea155e5ee "Bluetooth: L2CAP: Fix not tracking outstanding TX ident" changed ident allocation to use an IDA, releasing idents in l2cap put ident when th...

PT-2026-72512

In the Linux kernel, the following vulnerability has been resolved: gpio: mvebu: free generic chips on unbind irq alloc domain generic chips allocates generic chip data that must be freed via irq domain remove generic chips. The devres action mvebu gpio remove irq domain only called irq domain...

PT-2026-72508

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft lookup: fix catchall element handling with inverted lookups nft lookup eval decides whether a lookup matched found from the direct set lookup and priv-invert before falling back to the catchall element used by...

PT-2026-72506

In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets parse dfs referrals validates that the response header and referral array fit in the received buffer, but each referral also contains string offsets supplied by the server. Those offsets...