PT-2026-72852

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix memory leak in radeon ring restore on lock failure radeon ring restore takes ownership of the data buffer allocated by radeon ring backup. The caller radeon gpu reset only frees it in the non-restore branch; in th...

PT-2026-72832

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure mlx5r umr update xlt allocates and DMA maps an XLT buffer with mlx5r umr create xlt. The buffer is released by the common cleanup path through mlx5r umr unmap free xlt. After...

Linux Distros Unpatched Vulnerability : CVE-2026-74523

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - qede: sync udptunnel ports outside qedelock in the recovery path A TX timeout on a qede NIC that has VXLAN/GENEVE tunnel ports configured wedges the rtnetlink...

PT-2026-72329

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 IRQ SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next...

PT-2026-72520

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Prevent PM resume deadlock in hwctx sync debug bo amdxdna hwctx sync debug bo invokes the hardware hwctx sync debug bo callback while holding xdna-dev lock. The callback may call amdxdna cmd submit, which in turn...

PT-2026-72314

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix use-after-free race with concurrent NETDEV UNREGISTER isotp release looked up the bound network device via dev get by index using the stored ifindex. During device unregistration the device is unlisted from the...

PT-2026-72650

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race in unix socket mediation when peer path is used The holding a reference to the peer sk is not enough to ensure access to the peer sk path. Accessing the path outside of the state lock allows for a race with uni...

PT-2026-72995

In the Linux kernel, the following vulnerability has been resolved: net: udp tunnel: fix memory leak in udp tunnel nic unregister syzbot reported a memory leak 1 in the UDP tunnel NIC offload code. When device registration fails e.g. in register netdevice, netdev core unwinds by sending a single...

PT-2026-72990

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso connect ind Accessing iso pisk-conn requires lock sock, which is not taken in the "ev3" part of iso connect ind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states...

PT-2026-72963

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix pending command UAF in EIR updates MGMT OP SET LOCAL NAME is handled asynchronously on powered controllers and can run set name sync. When the controller is BR/EDR capable, set name sync updates the local nam...

PT-2026-72773

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks NMI and tracepoint BPF programs can re-enter the per-CPU or global LRU lock that bpf lru pop free/push free already hold on the same CPU, AA-deadlocking. Lockdep reports...

PT-2026-72774

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject sleepable BPF LSM CGROUP programs at load time The cgroup shim runs under rcu read lock dont migrate, so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts...

PT-2026-72761

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: use kfree rcu for offchannel link in mt76 put vif phy link mt76 put vif phy link frees the offchannel mlink with plain kfree after rcu assign pointerNULL. However, rcu assign pointer only prevents future RCU readers...

PT-2026-72991

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso sock getname Accessing iso pisk-conn requires lock sock, which is not held here. Fix by adding the lock/release...

PT-2026-72306

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix data race on rx stamp/rx ifindex in bcm rx handler For an rx op subscribed on all interfaces ifindex == 0, the same op is registered once in the shared per-netns wildcard filter list, so bcm rx handler can run...

PT-2026-72204

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list A pseudo-locked group's RMID is freed when it is created. On unmount rmdir all sub unconditionally frees all RMID of all groups, resulting in a double-free of...

PT-2026-72378

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix mrec lock ABBA deadlock in rename ntfs file fsync, ntfs dir fsync and ntfs write inode lock an inode's mrec lock before taking the mrec lock of its parent directory. ntfs rename takes old ni-mrec lock and old dir ni-mre...

PT-2026-72340

In the Linux kernel, the following vulnerability has been resolved: tpm: tpm tis spi: Use wait woken in wait for tmp stat wait event interruptible timeout evaluates its condition after setting the current task state to TASK INTERRUPTIBLE. With CONFIG DEBUG ATOMIC SLEEP this triggers a warning whe...

PT-2026-72528

In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: fix races on the shared Super VCAP block The VCAP instances on a chip are not independent, yet they are locked independently. On sparx5 and lan969x the IS0 and IS2 instances are backed by the same Super VCAP...

PT-2026-72502

In the Linux kernel, the following vulnerability has been resolved: regulator: core: regulator lock two should test for EDEADLK not EDEADLOCK Compare against -EDEADLK, which is what ww mutex lock actually returns and what every other deadlock check in this file already uses. Function regulator lo...