PT-2026-72856

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Reject VMAs with VM IO or VM PFNMAP when creating SVM ranges VMAs marked with VM IO or VM PFNMAP are not backed by struct page objects, which GPUSVM requires in order to operate correctly. In particular, get pages...

PT-2026-72834

In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: bail out of dad failure when state is no longer POSTDAD addrconf dad failure transitions ifp-state from DAD to POSTDAD via addrconf dad end, which drops ifp-lock on return. The lock is re-acquired after net info...

PT-2026-72820

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvme ns head struct nvme ns head contains a flexible array member, current path, which is indexed using the NUMA node ID: head-current pathnuma node id The structure is currently...

PT-2026-72789

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: always resume all after suspend all Need to restore any good queues even if the suspend all failed for some. Always run remove queue as that will schedule a GPU reset is removing the queue fails. v2: move resume all...

PT-2026-72863

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls a...

PT-2026-72864

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix double unlock in rxrpc recvmsg Fix a double unlock in rxrpc recvmsg when dealing with OOB messages...

PT-2026-72865

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the reception of a reply packet before data transmission Fix rxrpc receiving reply to handle the reception of an apparent reply DATA packet before rxrpc has had a chance to send any request DATA packets on a client cal...

PT-2026-72190

In the Linux kernel, the following vulnerability has been resolved: memstick: ms block: reject a card that reports too many blocks msb ftl initialize computes the zone count from the card block count with no bound: msb-zone count = msb-block count / MS BLOCKS IN ZONE; ... for i = 0; i zone count;...

PT-2026-72181

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix permanently busy scans after multiple roam iterations In order for the firmware to sleep, the driver has to confirm a previously received sleep request. The normal sequence of evets goes like this: EVENT SLEEP ...

PT-2026-72677

In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvec rx completed In nvec rx completed, when an incomplete RX transfer is detected, nvec msg free is called to return the message back to the pool by clearing its 'used' atomic flag. Immediate...

PT-2026-72782

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev//patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating...

PT-2026-72805

In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix u-a-f in luo file unpreserve files and luo file finish In luo file unpreserve files and luo file finish, reorder module put and xa erase to ensure the file handler module remains pinned while its operations are...

PT-2026-72802

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in change sta links for unready link ieee80211 set active links calls ieee80211 link use channel for each newly-added link and WARN ON ONCEs if it fails. The call uses assign on failure=true, which...

PT-2026-72808

In the Linux kernel, the following vulnerability has been resolved: raid1: fix nr pending leak in REQ ATOMIC bad-block error path In raid1 write request, each per-mirror loop iteration begins by incrementing rdev-nr pending. If a REQ ATOMIC write encounters a badblock within the requested range,...

PT-2026-72528

In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: fix races on the shared Super VCAP block The VCAP instances on a chip are not independent, yet they are locked independently. On sparx5 and lan969x the IS0 and IS2 instances are backed by the same Super VCAP...

PT-2026-72533

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback On failure at index i, the reverse cleanup loop in mlx5 lag create single fdb starts from i, so the failed index itself is rolled back. That can operate on uninitialized...

PT-2026-72741

In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 "bpf: Fix oob access in cgroup local storage" is still incomplete. The prog-array compatibility check treats a program with no cgroup storag...

PT-2026-72241

In the Linux kernel, the following vulnerability has been resolved: net: ip6 gre: require CAP NET ADMIN in the device netns for changelink ip6gre changelink and ip6erspan changelink operate on at most two netns, dev netdev and the tunnel link netns t-net. They differ once the device is created in...

PT-2026-72297

In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consistency on commit failure reserve metadata snap and release metadata snap modify the superblock's held root directly in the block manager's buffer. If the subsequent metadata commit...

PT-2026-72267

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - validate control endpoint type The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint...