PT-2026-72812

In the Linux kernel, the following vulnerability has been resolved: md/raid10: reset read slot when reusing r10bio for discard put all bios always drops devsi.bio, but it only drops devsi.repl bio when r10 bio-read slot 0. If discard reuses an r10bio that was previously used for a read, read slot...

PT-2026-72536

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop The ah, hbh and rt matches check that the fixed extension header is present, then use the header length field to derive the advertised extension header lengt...

PT-2026-72560

In the Linux kernel, the following vulnerability has been resolved: afs: Fix lack of locking around modifications of net-cells dyn ino Fix the lack of locking around modifications of net-cells dyn ino by taking net-cells lock exclusively. This also requires to cell to be removed from net-cells dy...

PT-2026-72840

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix snp filter reserved mem regions off-by-one Sashiko notes: regarding the bounds check in snp filter reserved mem regions called via walk iomem res desc: does the check if range list-num elements 16 + 8 PAGE SIZE...

PT-2026-72832

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure mlx5r umr update xlt allocates and DMA maps an XLT buffer with mlx5r umr create xlt. The buffer is released by the common cleanup path through mlx5r umr unmap free xlt. After...

PT-2026-72849

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix wrong pci get drvdata type in AER handlers rtw89 stores an ieee80211 hw pointer via pci set drvdata at probe time, but io error detected and io resume retrieve it as a net device pointer. This causes netif device...

PT-2026-72772

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bound S1G TIM PVB walk to the TIM element ieee80211 s1g check tim parses the S1G Partial Virtual Bitmap PVB of a received TIM element. The TIM is handed in as the element payload: ieee802 11 parse elems full store...

PT-2026-72711

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix out-of-bounds access in cxl cancel auto attach In cxl cancel auto attach, it assumes cxled-pos is a valid index for accessing p-targets. However, cxled-pos can be set to negative errno in cxl region sort targets i...

PT-2026-72722

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses dev get tstats64 as its ndo get stats64 callback, but pfcp link setup does not request NETDEV PCPU STAT TSTATS. The net core therefore leaves dev-tstats NULL for PFCP...

PT-2026-72720

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch hfsc: Don't make class passive twice update vf is called from two places for the same class during a single dequeue when the class's child qdisc e.g. codel/fq codel drops its last packets while dequeuing: 1. The...

PT-2026-72757

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid pointer dereference in btrfs run delayed refs In the beginning of the loop, we try to obtain a locked delayed ref head, if 'locked ref' is currently NULL, by calling btrfs select ref head, which can return an...

PT-2026-72283

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-fence: Fix potential NULL pointer dereference The commit mentioned in the fixes tag below introduced a mechanism through which fence producers can fully decouple from fence consumers. This, desirable, mechanism is...

PT-2026-72278

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fw log from bo validates the tracing buffer header size and that the log fits within the BO, but never checks that log-size is at least log-header size. fw log print...

PT-2026-72320

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Prevent shared tags across queues on Apple A11 On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag...

PT-2026-72257

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Use u64 multiplication in update rlimit cpu update rlimit cpu converts the RLIMIT CPU value to nanoseconds with u64 nsecs = rlim new NSEC PER SEC; On 32-bit kernels both rlim new unsigned long and NSEC PER SEC...

PT-2026-72706

In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent tlshd. ACCEPT already requires GENL ADMIN PERM; DONE ha...

PT-2026-72859

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix leak when pinning ubuf pages When pin user pages fast returns fewer pages than requested, the pages that were successfully pinned are not released, leading to a leak. Fix this by unpinning any partially pinned...

PT-2026-72873

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix deadlock if uvc status stop is called from async ctrl.work If a UVC camera has an asynchronous control, uvc status stop may be called from async ctrl.work: uvc ctrl status event work uvc ctrl status event uvc...

PT-2026-72867

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential infinite loop in rxrpc recvmsg Fix the wait in rxrpc recvmsg also take check the oob queue...

PT-2026-72763

In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix NULL pointer dereference in is vm area hugepages find vm area can return NULL if the given address is not a valid vmalloc area. Check the return value before dereferencing it to avoid a kernel crash...