PT-2026-72229

In the Linux kernel, the following vulnerability has been resolved: ipmi: fix refcount leak in i ipmi request When a caller provides a supplied recv message to i ipmi request, the function increments the user's nr msgs reference count. If an error occurs later, the out err cleanup path only frees...

PT-2026-72204

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list A pseudo-locked group's RMID is freed when it is created. On unmount rmdir all sub unconditionally frees all RMID of all groups, resulting in a double-free of...

PT-2026-72206

In the Linux kernel, the following vulnerability has been resolved: net: macb: drop in-flight Tx SKBs on close The MACB driver has since forever leaked the outgoing SKBs that have not yet been marked as completed. They live in queue-tx skb which gets freed without remorse nor checking. macb free...

PT-2026-72390

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid heap allocation for free-cluster readahead state get nr free clusters allocates a temporary file ra state before it publishes the precomputed free cluster count, sets NVolFreeClusterKnown, and wakes vol-free waitq. If...

PT-2026-72340

In the Linux kernel, the following vulnerability has been resolved: tpm: tpm tis spi: Use wait woken in wait for tmp stat wait event interruptible timeout evaluates its condition after setting the current task state to TASK INTERRUPTIBLE. With CONFIG DEBUG ATOMIC SLEEP this triggers a warning whe...

PT-2026-72524

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control get l2cap conn looks up an LE hci conn under hdev protection, but then drops that protection before reading hcon-l2cap data and before lowpan control write later...

PT-2026-72513

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path Branch Sampling BRS and Last Branch Record LBR are mutually exclusive hardware features, and users of both are tracked via cpuc-lbr users. When SVM is toggled on a CP...

PT-2026-72555

In the Linux kernel, the following vulnerability has been resolved: iomap: guard io size EOF trim against concurrent truncate underflow iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that io size tracks only valid data within EOF. This trims io size whe...

PT-2026-72525

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpan enable set allocates a temporary work item and schedules do enable set on system wq, then returns to debugfs. The debugfs active operation has ended at that point, but the...

PT-2026-72557

In the Linux kernel, the following vulnerability has been resolved: minix: avoid overflow in bitmap block count calculation minix check superblock uses minix blocks needed to verify that the on-disk imap and zmap block counts are large enough for the advertised inode and zone counts. The helper...

PT-2026-72626

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writes pending and barrier reference leaks on discard failures raid10 make request acquires a writes pending reference with md write start before calling raid10 handle discard. Several failure paths in raid10 handl...

PT-2026-72503

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix busy dentry warning on unmount after DIO Commit c68337442f03 "cifs: Fix busy dentry used after unmounting" fixed the issue in cifs where deferred close of a file led to a dentry reference count not being released...

PT-2026-72493

In the Linux kernel, the following vulnerability has been resolved: VDUSE: avoid leaking information to userspace The bounceing is not necessarily page aligned, so current VDUSE can leak kernel information through mapping bounce pages to userspace. Allocate bounce pages with GFP ZERO to avoid...

PT-2026-72431

In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are checked when using TCP Fast Open. Update...

PT-2026-72441

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack sip: validate skb dst before accessing it tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relie...

PT-2026-72387

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident index root values on lookup Resident $INDEX ROOT values carry index header fields that callers consume after lookup. Some callers already validate parts of the layout before walking entries, but those chec...

PT-2026-72369

In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASK OFFSTACK memory corruption This patch addresses a critical memory management flaw. When CONFIG CPUMASK OFFSTACK is enabled, cpumask var t is a pointer. Consequently, sizeofnew mask evaluates to the pointe...

PT-2026-72568

In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response req id before indexing rsp pvcalls front event handler takes req id directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a stor...

PT-2026-72561

In the Linux kernel, the following vulnerability has been resolved: afs: Fix missing NULL pointer check in afs break some callbacks Fix afs break some callbacks to check to see if afs lookup volume rcu returned NULL e.g. the specified volume is unknown...

PT-2026-72592

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in cleanup bearer due to premature dst cache destroy TIPC UDP media bearer teardown calls dst cache destroy on its replicast caches before calling synchronize net to wait for concurrent RCU readers transmitters to...