PT-2026-116927

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replace ctx pointers between the old WILL BE REPLACED chanctx and the new REPLACES OTHER chanctx. However, the early free paths only consider...

PT-2026-117084

In the Linux kernel, the following vulnerability has been resolved: sched ext: Don't run ops.dequeue with a DSQ lock held ops.dequeue is invoked with the source user DSQ's lock still held on the consume and move paths scx consume dispatch q, move task between dsqs. A BPF scheduler which locks the...

PT-2026-116957

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access build pairing cmd looks up remote OOB data and copies its contents without holding hdev-lock, which serializes the list's writers. After SMP finds an entry, a concurrent management...

CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2024:1722977984)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2024:1722977984 advisory. - In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the adap structure on...

PT-2026-116705

In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure ena device init initializes the MMIO read mechanism with ena com mmio reg read request init, which allocates a coherent DMA buffer for MMIO read responses. The normal removal...

PT-2026-116672

In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2 open accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2 parse contexts rejects malformed context data, SMB2 open...

PT-2026-116787

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlan na create samples LL RESERVED SPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlan changelink can update needed headroom betwee...

PT-2026-116795

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfc llcp wks sap and nfc llcp build sdreq tlv pass non-null- terminated strings to pr debug using the %s format specifier. The buffers are allocated via kmemdup o...

PT-2026-116827

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak in virtio gpu resource create ioctl virtio gpu resource create ioctl calls drm gem object release on the drm gem handle create error path instead of dropping the reference it owns, so obj-funcs-free...

PT-2026-116828

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drm gem handle create fails virtio gpu gem create owns the reference taken by virtio gpu object create. On the drm gem handle create error path it calls drm gem object release instead of dropping...

PT-2026-116834

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Set AW FLUSH MODE alongside AW FLUSH when flushing the mailbox When tearing down the FW mailbox Rx ring, fbnic mbx reset desc ring writes AW CFG with FLUSH set and everything else, BME included, cleared. Clearing BME...

PT-2026-116836

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: use the Rx queue napi pointer to find the napi vector The queue management ndos pick the napi vector for an Rx queue with: nv = fbn-napiidx % fbn-num napi; The issue is this is only correct in the cases where there ar...

PT-2026-116830

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpf crypto ctx create is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that params sz bytes of params are valid. The functi...

PT-2026-116813

In the Linux kernel, the following vulnerability has been resolved: tg3: clean up PHYLIB resources on probe failure tg3 get invariants can register an MDIO bus and connect a PHY for USE PHYLIB devices. If tg3 init one later fails, its common error path releases the mappings and netdev without...

PT-2026-116794

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533 acr122 is rx frame valid frame-ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame-data. A malicious or malfunctioning device can set this field ...

PT-2026-116746

In the Linux kernel, the following vulnerability has been resolved: gpio: zynq: fix runtime PM leak on request error path pm runtime get sync leaves the usage counter incremented even when it fails, and zynq gpio request returns the error without dropping it. gpiolib does not call -free when...

PT-2026-116784

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 The core and io supplies are only requested for ID MT7530: both the devm regulator get in probe and the regulator enable in mt7530 setup are guarded by the...

PT-2026-116793

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: stop Tx NAPI before disabling the queues bcmgenet netif stop and the Wake-on-LAN branch of bcmgenet suspend both disable the Tx queues first and stop Tx NAPI several steps later. A completion in flight calls netif ...

PT-2026-116750

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6 ATTR DST In seg6 genl policy, SEG6 ATTR DST is defined with .type = NLA BINARY and .len = sizeofstruct in6 addr. For NLA BINARY, .len only enforces the maximum payload length and...

PT-2026-116755

In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanup offline cgwbs workfn drains a dying cgwb by calling cleanup offline cgwb until it returns false, with a cond resched between passes. On a CONFIG PREEMPTION...