PT-2026-72416

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: fix primary if leak on failed linearization If the skb has a frag list, it must be linearized before it can be split using skb split. But when this step failed, it must not only free the skb but also take care o...

PT-2026-72373

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix WARN ON for resident attribute in ntfs map runlist nolock When ntfs map runlist nolock needs to look up the attribute extent containing a target VCN ctx needs reset == true, it calls ntfs attr lookup and then expects th...

PT-2026-72609

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore error route in local/main tables. When CONFIG IP MULTIPLE TABLES is enabled but no rule is added, fib lookup performs route lookup directly on two tables. Since the first lookup does not properly bail out,...

PT-2026-72690

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSO BY FRAGS 0xFFFF When MTU is large, ip6 default advmss can return IPV6 MAXPLEN 65535. This is interpreted by TCP as mss clamp, allowing the MSS to reach 65535. However, 0xFFFF is...

PT-2026-72428

In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix reference leak on failed device registration When platform device register fails in sm501 register device, the embedded struct device in pdev has already been initialized by device initialize, but the failure path...

PT-2026-72575

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix potential invalid pointer deref in group process tiler oom If heaps is an ERR PTR, panthor heap pool put will deref an invalid pointer. Make sure we set it to NULL in that case...

PT-2026-72670

In the Linux kernel, the following vulnerability has been resolved: gpib: fix double decrement of descriptor busy in command ioctl commit d1857f8296dc "gpib: fix use-after-free in IO ioctl handlers" introduced a descriptor busy reference counter to pin struct gpib descriptor across IO ioctl...

PT-2026-72258

In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rt spin unlock rt spin unlock releases the RCU protection before unlocking the lock. That opens the door for the following UAF scenario: T1 T2 spin lock&p-lock; rcu read lock;...

PT-2026-72224

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch taprio: Replace direct dequeue call with peek and qdisc dequeue peeked When taprio's software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gso skb; taprio dequeue from txq...

PT-2026-72188

In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation ip vs get out rt calls skb ensure writable which may reallocate skb-head...

PT-2026-72179

In the Linux kernel, the following vulnerability has been resolved: mtd: mchp23k256: use SPI match data for chip caps The driver stores chip capacity information in both the OF match table and the SPI id table. Probe currently uses of device get match data, so a non-OF SPI modalias match falls ba...

PT-2026-72182

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

PT-2026-72386

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject non-resident records for resident-only attributes The shared lookup-time attribute validator rejects non-resident $FILE NAME and $VOLUME NAME records because their formats require resident values and callers handle...

PT-2026-72396

In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfs ea lookup and ntfs listxattr, this verifies that there is enough space in the EA entry before accessing the next entry offset field of the EA entry...

PT-2026-72517

In the Linux kernel, the following vulnerability has been resolved: net/liquidio: drop cached VF pci dev LUT The PF SR-IOV enable path caches VF pci dev pointers in dpiring to vfpcidev lut by iterating with pci get device. Those entries do not own a reference, because the iterator drops the...

PT-2026-72611

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an opts sz argument. The verifier checks only the memory range described by opts sz, but the wrappers...

PT-2026-72628

In the Linux kernel, the following vulnerability has been resolved: md/raid1: fix writes pending and barrier reference leaks on write failures raid1 make request acquires a writes pending reference with md write start before calling raid1 write request. Several failure paths in raid1 write reques...

PT-2026-72496

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw sp port lag join When mlxsw sp port lag index get fails, mlxsw sp port lag join returns an error without releasing the lag reference obtained by the earlier mlxsw sp lag get. All other error path...

PT-2026-72424

In the Linux kernel, the following vulnerability has been resolved: s390/perf cpum cf: Add missing array index nospec to hw perf event init ev variable is userspace controlled via event-attr.config and used as an array index after bounds checking, but without speculation barriers. Add the missing...

PT-2026-72425

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/brs: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERF SAMPLE BRANCH USER is requested. On...