PT-2026-90237

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in core scheduling where the pick next task function fails when a pick task implementation releases the rq lock. The selection state established at the start is only vali...

PT-2026-90224

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/ucma component where the ucma set ib path function calls ucma event handler during a write path without acquiring the necessary handler lock. This failure to...

PT-2026-90421

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd dispatch function where the rq status counter is not consistently restored to an even value on all exit paths. Specifically, cache-hit RC REPLY, drop RC DROPI...

PT-2026-90283

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The jbd2 shrinker fails to account for busy buffers when calculating the scan budget against nr to scan, meaning only successfully released checkpoint buffers are counted. When a...

PT-2026-90325

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ecryptfs component. The function ecryptfs exorcise daemon drops queued messages from a dying daemon without holding the ecryptfs msg ctx lists mux lock...

PT-2026-90378

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free flaw exists in the NFSD client teardown process. The destroy client function releases a client's open owners, but a lock owner whose only reference is a blocked lock...

PT-2026-90376

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Network File System server NFSD during admin state revocation. The problem occurs because a stateid contains a pointer to the nfs4 client without...

PT-2026-90428

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the nfsd4 ssc expire umount function when iterating through the nn-nfsd ssc mount list. The function drops the nfsd ssc lock to execute mntput on the source...

PT-2026-90236

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the core scheduling mechanism where the pick next task function operates on sibling runqueues under a shared core-wide lock. If pick task releases the runqueue...

PT-2026-96537

In the Linux kernel, the following vulnerability has been resolved: jbd2: check need resched when skipping busy checkpoint buffers journal shrink one cp list skips busy checkpoint buffers when called with JBD2 SHRINK BUSY SKIP. The continue statement on this path also skips the need resched check...

PT-2026-96570

In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssp lock before publishing proc entry create use gss proxy proc entry publishes /proc/net/rpc/use-gss-proxy via proc create data before init gssp clnt runs mutex init on sn-gssp lock. Once the dentry is linked under...

PT-2026-96554

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfs exorcise daemon drops queued messages from a dying daemon without holding ecryptfs msg ctx lists mux, but ecryptfs msg ctx alloc to free requires that lock. Tak...

PT-2026-96533

In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's pick next task operates on all sibling rqs under one acquisition of the shared core-wide lock. A -pick task that releases the rq lock leaves every...

PT-2026-96408

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup when scanning task stacks Patch series "mm/kmemleak: avoid soft lockup when scanning task", v3. kmemleak scan scans every task stack under one rcu read lock with no reschedule point, which can trip...

PT-2026-96392

In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nr to scan. Busy buffers therefore do not consume the scan budget. If a...

PT-2026-96354

In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicm probe registers the display before initializing ddata-lock. Once omapdss register display publishes the display, another consumer can reach a dsicm...

CVE-2026-89521: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle picktask releasing the rq lock Core scheduling's picknexttask breaks when a -picktask implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held...

CVE-2026-89520: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's picknexttask operates on all sibling rqs under one acquisition of the shared core-wide lock. A -picktask that releases the rq lock leaves every...

CVE-2026-80954: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: i3c: Fix unlocked dereference of dev-desc in i3cdevicegetsupportedxfermode i3cdevicegetsupportedxfermode uses dev-desc to obtain the master controller. However, dev-desc must not be dereferenced unless bus-lock is held, and this...

CVE-2026-80953: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: i3c: master: adi: initialize the lock before enabling interrupts adii3cmasterprobe requests the IRQ and unmasks REGIRQPENDINGCMDR before the controller's IBI state, transfer queue list and transfer queue lock are initialized. A...