PT-2026-72418

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: free unfragmentable packet The caller of batadv frag send packet assume that the skb provided to the function are always consumed. But the pre-check for an empty payload or the zero fragment size returned an err...

PT-2026-72988

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release iso sock kill tests !sock flagsk, SOCK ZAPPED || sk-sk socket || sock flagsk, SOCK DEAD for early return, but this is always true since sock orphansk sets SOCK DEAD, so the sk...

PT-2026-72228

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix potential memory leak in bnx2x alloc mem bp If the allocation of fpi.tpa info fails, the error path will not free the struct bnx2x fastpath allocated earlier, as it is not linked to the bp structure yet. Fix that by...

PT-2026-72276

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfc sli4 driver resource setup The memory allocated for mboxq using mempool alloc is not freed in some of the early exit error paths. Fix that by moving the mempool free call to an earlier point...

PT-2026-72717

In the Linux kernel, the following vulnerability has been resolved: tipc: reject inverted service ranges from peer bindings tipc update nametbl inserts a binding advertised by a peer node using the lower and upper service-range bounds taken directly from the wire, without checking that lower uppe...

PT-2026-72457

In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: fix potential memory leak in uvesafb probe Due to an incorrect goto label, memory allocated for modedb and modelist in uvesafb vbe init is not freed in some error paths. Fix this by updating the goto label...

PT-2026-72649

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the sk ctx Currently update sk ctx transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller conditionally put the...

PT-2026-72298

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: unregister blocking notifier on init failure sparx5 register notifier blocks registers the switchdev blocking notifier before allocating the ordered workqueue. If the workqueue allocation fails, the error path...

PT-2026-72459

In the Linux kernel, the following vulnerability has been resolved: fbdev: i740fb: fix potential memory leak in i740fb probe In i740fb probe, the memory allocated in fb videomode to modelist for modelist is not freed in the error paths. Fix that by calling fb destroy modelist...

PT-2026-72407

In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm file leak when nlm do fopen fails A client can repeatedly drive nlm do fopen failures by presenting file handles that the underlying export rejects. After kzalloc obj succeeds in nlm lookup file, the freshly...

PT-2026-72715

In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sg cleanup error path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

PT-2026-72366

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: always put unsuccessfully committed target pids damon commit target puts and gets the destination and the source target pids. It puts the destination target pid because it will be overwritten by the source target...

PT-2026-72215

In the Linux kernel, the following vulnerability has been resolved: irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure imsic early acpi init allocates a firmware node before setting up the IMSIC state. If imsic setup state fails, the function returns without freeing the allocat...

PT-2026-72559

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFS VOLUME RM TREE is set on Fix afs insert volume into cell to set AFS VOLUME RM TREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volum...

PT-2026-72544

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs issue read Fix missing release of credits in the failure path in cifs issue read lest retrying the subreq just overwrites the credits value...

PT-2026-72229

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak exists in the i ipmi request function. When a caller provides a supplied recv message, the function increments the nr msgs reference count. If an error occurs, the...

PT-2026-72247

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ixp4xx hss probe function where two HDLC netdevs are allocated instead of one. The first allocation is stored in ndev, initialized, and registered via register hdl...

PT-2026-72509

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential memory leaks in igmp mod timer and igmp stop timer When a timer is deleted and not re-armed in igmp mod timer, or stopped in igmp stop timer, the code currently decrements the reference counter of the...

PT-2026-72326

In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: fix error handling in ioctl When gntdev ioctl map grant ref fails to copy the operation result back to userspace after successfully adding the mapping to the list, the error path returns -EFAULT without releasing the...

PT-2026-72462

In the Linux kernel, the following vulnerability has been resolved: fbdev: hecubafb: fix potential memory leak in hecubafb probe The memory allocated for pagerefs in fb deferred io init is not freed on the error path. Fix it by calling fb deferred io cleanup...