PT-2026-72630

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix and simplify IP6IP6 tunnel handling Fix nf flow ip6 tunnel proto to use pskb may pull instead of skb header pointer to ensure the outer IPv6 header is in the skb headroom, which is required for subsequen...

PT-2026-72495

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw sp vrs lpm tree replace When mlxsw sp vrs lpm tree replace fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the...

PT-2026-72342

In the Linux kernel, the following vulnerability has been resolved: openrisc: Fix jump label smp syncing The original commit 8c30b0018f9d "openrisc: Add jump label support" copies from arm64 and does not properly consider how icache invalidation on remote cores works in OpenRISC. On OpenRISC remo...

PT-2026-72678

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtw aes decrypt The null-pointer-guard was incorrect, returning FAIL on valid pointer. Invert the guard, so it returns FAIL on invalid pointer...

PT-2026-72788

In the Linux kernel, the following vulnerability has been resolved: of: reserved mem: avoid post-init UAF when alloc reserved mem array fails The global pointer 'reserved mem' continues to reference the reserved mem array which lives in initdata if alloc reserved mem array fails. of reserved mem...

PT-2026-72552

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix writeback error handling Fix the error handling in writeback iter loop. If an error occurs, writeback iter needs to be called again with error set to the error so that it can clean up iteration state. Further, the...

PT-2026-72715

In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sg cleanup error path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

PT-2026-72215

In the Linux kernel, the following vulnerability has been resolved: irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure imsic early acpi init allocates a firmware node before setting up the IMSIC state. If imsic setup state fails, the function returns without freeing the allocat...

PT-2026-72187

In the Linux kernel, the following vulnerability has been resolved: reset: sunxi: fix memory region leak on ioremap failure In sunxi reset init, when ioremap fails, the memory region obtained via request mem region is not released, leading to a resource leak. Add an err mem region label to proper...

PT-2026-72242

In the Linux kernel, the following vulnerability has been resolved: net: ipip: require CAP NET ADMIN in the device netns for changelink ipip changelink operates on at most two netns, dev netdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other th...

PT-2026-72866

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpc input ackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new servic...

PT-2026-72177

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: fix esdhc change pinstate to allow default state restore esdhc change pinstate checks for pins 100mhz and pins 200mhz at the top of the function and returns -EINVAL if either is not defined. This prevents th...

PT-2026-72543

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix barriering when walking subrequest list Fix the barriering used when walking the subrequest list in retry as there's a possibility of seeing a subreq that's just been added by the application thread...

PT-2026-72814

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in get srq wqe get srq wqe reads wqe-dma.num sge from the shared receive queue buffer, which is mapped into userspace. It validates num sge against max sge, but then re-reads the same field to...

PT-2026-72324

In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm interface: require CAP NET ADMIN in the device netns for changelink xfrmi changelink operates on at most two netns, dev netdev and the interface link netns xi-net. They differ once the device is created in or moved to ...

PT-2026-72325

In the Linux kernel, the following vulnerability has been resolved: xfrm: nat keepalive: avoid double free on send error nat keepalive send frees the keepalive skb whenever the IPv4 or IPv6 send helper reports an error. That cleanup is only correct before the skb is handed to the output path. Onc...

PT-2026-72667

In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: handle I2C read errors in mma8452 read Currently, If i2c smbus read i2c block data fails but mma8452 set runtime pm state succeeds, mma8452 read returns 0. As a result, the caller mma8452 read raw assumes the...

PT-2026-72572

In the Linux kernel, the following vulnerability has been resolved: irqchip/ts4800: Fix missing chained handler cleanup on remove The driver installs a chained handler for the parent interrupt during probe using irq set chained handler and data, but the remove function does not clear this handler...

PT-2026-72366

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: always put unsuccessfully committed target pids damon commit target puts and gets the destination and the source target pids. It puts the destination target pid because it will be overwritten by the source target...

PT-2026-72387

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident index root values on lookup Resident $INDEX ROOT values carry index header fields that callers consume after lookup. Some callers already validate parts of the layout before walking entries, but those chec...