PT-2026-72489

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes put and bytes get In sof ipc3 bytes put, the size used for the memcpy is derived from the old data-size already in the buffer, not the incoming new data's size field. If the new data h...

PT-2026-72448

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Check runtime resume during probe The MT8192 AFE probe enables runtime PM temporarily while reinitializing the regmap cache from hardware, but it uses pm runtime get sync without checking the return value...

PT-2026-72361

In the Linux kernel, the following vulnerability has been resolved: fs/proc/task mmu: do not warn on seeing non-migration pmd entry Patch series "mm/hmm: A fix and a selftest", v3. Patch 1 fixes a stale warning present from the time when only migration softleaf entries were supported at the PMD...

PT-2026-72353

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix condition in 'nand select target' 'cs' here must be in range 0:nanddev ntargets...

PT-2026-72440

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft set pipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nft pipapo match can enter a bad state: - some fields can have their lookup tables resized while others did not - bit...

PT-2026-72400

In the Linux kernel, the following vulnerability has been resolved: mm/memory hotplug: fix incorrect altmap passing in error path In create altmaps and memory blocks, when arch add memory succeeds with memmap on memory enabled, the vmemmap pages are allocated from params.altmap. If create memory...

PT-2026-72433

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix device reference leak in host1x device parse dt error path After device initialize, the embedded struct device in struct host1x device should be released through the device core with put device. In host1x device...

PT-2026-72603

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Validate written enum value in ge put enum double ge put enum double passes the user-supplied enumeration index item0 to snd soc enum item to val without checking it against the number of items in the enum: ret = snd...

PT-2026-72580

In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6: fix NULL deref in fib6 walk continue on multi-batch dump inet6 dump fib saves its progress in cb-args1 as a positional index within the current hash chain. Between batches, a concurrent fib6 new table can insert a new...

PT-2026-72621

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft meta bridge: fix NFT META BRI IIFPVID stack leak This needs to test for nonzero retval...

PT-2026-72629

In the Linux kernel, the following vulnerability has been resolved: ieee802154: fix kernel-infoleak in dgram recvmsg KMSAN reported a kernel-infoleak in move addr to user: BUG: KMSAN: kernel-infoleak in instrument copy to user include/linux/instrumented.h:131 inline BUG: KMSAN: kernel-infoleak in...

PT-2026-72595

In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in geneve gro complete Even with both paths gated on gs-gro hint, geneve gro complete re-derives the inner dispatch type and length from the packet and the current gs-gro hint, independently ...

PT-2026-72599

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: fix use-after-free of DSA ports in crc err work Upon an MDIO CRC error mxl862xx crc err work fn walks the DSA ports and closes the CPU port conduits: dsa switch for each cpu portdp, priv-ds dev closedp-conduit...

PT-2026-72579

In the Linux kernel, the following vulnerability has been resolved: net: phy: sfp: free mii bus in sfp i2c mdiobus destroy sfp i2c mdiobus create allocates the I2C MDIO bus with mdio i2c alloc, a plain non-devm allocation, and registers it. sfp i2c mdiobus destroy only unregisters the bus and...

PT-2026-72588

In the Linux kernel, the following vulnerability has been resolved: seg6: validate SRH length before reading fixed fields seg6 validate srh reads fixed SRH fields such as srh-type and srh-hdrlen before checking that the supplied length covers the fixed struct ipv6 sr hdr fields. The BPF SEG6 enca...

PT-2026-72634

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: reject stream disable with no active interface handle uaudio stream req resolves an interface index with info idx from ifnum, which returns -EINVAL when no interface matches. The enable branch and the...

PT-2026-72288

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: don't increment hash offset twice hash offset is already incremented in the loop "for i = 0; i to copy; i++, ts--". Do not increment it again...

PT-2026-72590

In the Linux kernel, the following vulnerability has been resolved: bpf: Mask pseudo pointer values in verifier logs print bpf insn masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPF PSEUDO MAP FD and BPF PSEUDO MAP VALUE...

PT-2026-72578

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch teql: Introduce slaves lock to avoid race condition and UAF The teql master-slaves singly linked list is not protected against multiple writes. It can be mod'ed concurently from teql master xmit, teql dequeue, teql...

PT-2026-72619

In the Linux kernel, the following vulnerability has been resolved: alloc tag: fix use-after-free in /proc/allocinfo after module unload allocinfo start only reinitializes the codetag iterator at position 0. For subsequent reads position 0, it reuses cached iterator state from the previous batch...