PT-2026-79674

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip vs in icmp rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp send. However, IPCBskb-opt still describes the outer IPv4...

PT-2026-79607

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Initialise reader page order in rb allocate cpu buffer In rb allocate cpu buffer, bpage-order was omitted, leaving it as 0. This is an issue for a ring-buffer with subbufs bigger than PAGE SIZE if when freed: free...

PT-2026-79678

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - fix information leak in evdev pass values In evdev pass values, the input event structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. On architectures wher...

PT-2026-79649

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: putback folios on invalid migrate nid damon pa migrate and damos va migrate isolate folios into a local list and then call damon migrate pages. When target nid is invalid including the scheme default NUMA NO...

PT-2026-79627

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aq ring rx deinit only walks sw head, sw tail, the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page and its D...

PT-2026-79610

In the Linux kernel, the following vulnerability has been resolved: eventfs: Use children field for rcu head and add memory barriers When an eventfs inode is freed, it sets ei-is freed and then uses its ei-list to add it to the srcu link list as the list field is a union with the rcu list head. A...

PT-2026-79714

In the Linux kernel, the following vulnerability has been resolved: xsk: clear metadata pointer when no timestamp is requested User space can change metadata flags after request processing. Rereading them during completion can therefore make the kernel write a timestamp that was not requested whe...

PT-2026-79592

In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addip last asconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctp asconf queue teardown...

PT-2026-79622

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs-lock in dibs dev alloc dibs-lock is initialised by dibs dev add, but a dibs device can already take interrupts before that call: ism probe runs ism dev init, and hence request irq, before it calls dibs dev...

PT-2026-79648

In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: error out for zero quota goal target values Patch series "mm/damon: avoid division by zero from damos quota score". DAMON SAMPLE MTIER and DAMON LRU SORT allow the user to trigger division by zero in damos...

PT-2026-79713

In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsk tx metadata. Reject the request when the registered metadata area does not contain the complete field. Snapshot the...

PT-2026-79694

In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vcc setsockopt vcc setsockopt contained an ineffective optlen check: if SO LEVEL MATCHoptname, level && optlen != SO SIZEoptname return -EINVAL; If SO LEVEL MATCHoptname, level evaluated to...

PT-2026-79600

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscrypt ioctl set policy fscrypt ioctl set policy calls inode owner or capable with &nop mnt idmap before allowing an encryption policy to be set, instead of the idmap of the...

PT-2026-79673

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tpacket snd function where dev-hard header len is read independently during skb allocation and header construction within tpacket fill skb. Concurrent netdevice...

PT-2026-79595

In the Linux kernel, the following vulnerability has been resolved: fsverity: Fix bpf get fsverity digest dynptr assumptions The BPF verifier and the dynptr abstraction ensure that the memory space referenced by a dynptr remains valid. They do not, however, provide any guarantee that the contents...

PT-2026-79659

In the Linux kernel, the following vulnerability has been resolved: serial: 8250 dma: Clear stale RX state on shutdown serial8250 release dma terminates RX DMA and releases the channel, but leaves rx running set. If the port is closed while an RX transfer is active, the stale state remains while...

PT-2026-79594

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix sk redir use-after-free in send verdict sk psock msg verdict takes a socket reference for psock-sk redir. tcp bpf send verdict copies that pointer while holding the source socket lock, but does not take a...

PT-2026-79613

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs try adding channels cifs try adding channels takes a temporary reference to an interface before dropping iface lock. If cifs ses add channel fails, it drops that reference and then incremen...

PT-2026-79626

In the Linux kernel, the following vulnerability has been resolved: net/sched: act ct: fix sk buff leak when the header checks reject a packet tcf ct handle fragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTO IPV4 err = tcf ct ipv4 i...

PT-2026-79653

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtw cfg80211 monitor if xmit entry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data...