CVE-2026-98631: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...

CVE-2026-98788: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize pollstatesynchronizercumm-futex.phash.batches is used by futexrefdrop to check that a grace period has passed since the current hash was published. This relies on batches referenci...

PT-2026-116777

In the Linux kernel, the following vulnerability has been resolved: net: flush skb defer nodes in dev cpu dead When a CPU goes offline, dev cpu dead drains its softnet queues completion queue, output queue, poll list, process queue, and input pkt queue, but leaves net hotdata.skb defer nodes...

PT-2026-116660

In the Linux kernel, the following vulnerability has been resolved: net/sched: act ct: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up processing both again but with different sets of extensions. The series of events: 1. The...

PT-2026-116679

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore subm...

PT-2026-116656

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: fix runtime PM reference leaks Use pm runtime resume and get in iris enable power domains to avoid leaking a runtime PM usage count on failure. Also ensure pm runtime put sync is always called in iris disable...

PT-2026-116657

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mptcp module where the mptcp write data fin function fails to initialize certain values when sending a DATA FIN without data. Because a DATA FIN occupies one octet...

PT-2026-116677

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hci bind cis and hci connect cis return one hci conn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by iso conn fre...

PT-2026-116811

In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emac tx mem map writes TX DESC 0 OWN into the ring descriptor for every slot beyond old head as soon as that slot's memset'd local copy is committed with "tx desc add...

PT-2026-116723

In the Linux kernel, the following vulnerability has been resolved: PCI: of property: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

CVE-2026-98620: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: unregister netdevices in case of probe failure If registernetdev fails for one of the MTKMAXDEVS devices in mtkprobe, the error path jumps to errdeinitppe, skipping mtkunregdev. The previously registered...

PT-2026-116803

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in em text dump em text dump allocates struct tcf em text on the stack without zeroing it. strscpy writes the algorithm name and a NUL terminator into conf.algo, leaving the remaining bytes...

PT-2026-116789

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dst dev overhead The seg6, ioam6 and rpl lwtunnels size their skb cow head request as the length they are about to push plus dst dev overhead, then push the new headers and rebuild the m...

PT-2026-116987

In the Linux kernel, the following vulnerability has been resolved: usb: typec: anx7411 - stop the IRQ before destroying the workqueue The IRQ is devm-managed, so it can still queue plat-work while remove is tearing the queue down. Disable it first...

PT-2026-116748

In the Linux kernel, the following vulnerability has been resolved: gpio: arizona: Fix runtime PM leak in arizona gpio direction out Switching a persistent GPIO line from input to output acquires a runtime PM reference on the parent device, but if the subsequent regmap update bits fails the...

PT-2026-116927

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replace ctx pointers between the old WILL BE REPLACED chanctx and the new REPLACES OTHER chanctx. However, the early free paths only consider...

PT-2026-117084

In the Linux kernel, the following vulnerability has been resolved: sched ext: Don't run ops.dequeue with a DSQ lock held ops.dequeue is invoked with the source user DSQ's lock still held on the consume and move paths scx consume dispatch q, move task between dsqs. A BPF scheduler which locks the...

PT-2026-116957

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access build pairing cmd looks up remote OOB data and copies its contents without holding hdev-lock, which serializes the list's writers. After SMP finds an entry, a concurrent management...

PT-2026-116705

In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure ena device init initializes the MMIO read mechanism with ena com mmio reg read request init, which allocates a coherent DMA buffer for MMIO read responses. The normal removal...

PT-2026-116672

In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2 open accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2 parse contexts rejects malformed context data, SMB2 open...