PT-2026-116791

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix immediate JMP JEQ/JNE on MIPS32 An addu instruction was emitted instead of addiu, causing the immediate value 1 to be interpreted as register $at. This made the comparison result invalid when the immediate operand was...

PT-2026-116796

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfc llcp wks sap nfc llcp wks sap compares only service name len bytes, so a short service name like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exa...

PT-2026-116810

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skb pointer if linear function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. Th...

PT-2026-116805

In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before mod timer in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls mod timer before taking the reference needed by th...

PT-2026-116684

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVM RUN. As a result, kvm riscv aia imsic rw attr can snapshot the physical CPU and HGEI of an IMSIC VS-file before a...

PT-2026-116742

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drm atomic.c:2031 at drm atomic helper set config+0x18e/0x1b0 drm Call Trace: drm...

PT-2026-116659

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvm arch flush shadow all, which is a Bad Ideatm. Freeing the page tables is fair game this is what this callback is...

PT-2026-116708

In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpd cons read The hardware can report an out-of-range tpd cons seen as 0xffff while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would...

PT-2026-116700

In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100 recv response passes the URB transfer buffer to port100 rx frame is valid, which checksums le16 to cpuframe-datalen bytes of frame-data. datalen ...

PT-2026-116831

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catc rx done catc rx done walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pkt len urb-actual length, ignores the header offset and compares...

PT-2026-116710

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1...

PT-2026-117019

In the Linux kernel, the following vulnerability has been resolved: bpf: Wait for an RCU tasks grace period before freeing trampoline progs When a prog is detached from a trampoline, it is freed after an RCU grace period, or an RCU tasks trace one if it is sleepable. This covers the tasks that ar...

PT-2026-116771

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attach perf ctx data The attach perf ctx data can race on global and !global cases. The global case is protected by global ctx data rwsem and shares a single reference count using perf ctx...

PT-2026-116747

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpio desc to lineinfo, we return immediately before zeroing the info struct we'll end up passing to the user-space later i...

PT-2026-117049

In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfx hif read mib copies reply-length bytes from the firmware response into the caller-provided buffer without checking that reply-length does not exceed val len. A...

PT-2026-116787

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlan na create samples LL RESERVED SPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlan changelink can update needed headroom betwee...

PT-2026-116850

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xsk map gen lookup xsk map gen lookup loads a u32 key and compares it with max entries using BPF JMP IMM. BPF immediates are sign-extended to 64 bits, so a max entries value of 0x80000000 or higher...

PT-2026-116842

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkm clk ustate update If list for each entry exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead. The check is...

PT-2026-116927

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replace ctx pointers between the old WILL BE REPLACED chanctx and the new REPLACES OTHER chanctx. However, the early free paths only consider...

PT-2026-116715

In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdt work after releasing the WDT IRQ airoha npu remove calls cancel work sync on each core's wdt work, but the watchdog IRQ that queues it is requested with devm request irq and is freed only after .remov...