PT-2026-116774

In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llc mac hdr init failure In llc conn ac resend i xxx x set 0 or send rr, if llc mac hdr init fails, kfree skbskb is called instead of kfree skbnskb. This leaks the newly allocated nskb, reads from th...

PT-2026-116848

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls u32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it...

PT-2026-117008

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in free by rcu ttrace do call rcu ttrace returns early when call rcu ttrace in progress is set and leaves the objects in free by rcu ttrace. free rcu frees waiting for gp ttrace only and clears the flag...

PT-2026-116624

LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced in lodepng util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent...

PT-2026-117020

In the Linux kernel, the following vulnerability has been resolved: net: restrict SO RESERVE MEM to TCP sockets and cap max value Commit 2bb2f5fb21b0 "net: add new socket option SO RESERVE MEM" and commit d00c8ee31729 "net: fix possible NULL deref in sock reserve memory" only checked sk has...

PT-2026-116664

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repairs LOLLM complains that a memory allocation failure in xrep newbt add blocks results in online repair leaking blocks that were previously allocated to write a new btree, bu...

PT-2026-116654

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Use parent device for devres in altr portb setup Anchor the devres group and the devm-managed IRQ requests in altr portb setup to the actual parent device device-edac-dev instead of the embedded struct device inside...

PT-2026-116670

In the Linux kernel, the following vulnerability has been resolved: smb: client: use finish no open for non-regular inodes An O CREAT open can find an existing symlink or another non-regular inode. cifs atomic open calls finish open on it and attaches a cifsFileInfo. Symlink inodes have no CIFS...

PT-2026-116992

In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in port shutdown if disconnected acm port shutdown is called from the tty-port machinery whenever the last user closes the port. acm disconnect sets acm-disconnected and calls tty port tty vhangup,...

PT-2026-116666

In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots LOLLM noticed that the inode btree root formatting methods copy too many bytes -- there's only one set of keys in node blocks, not two. This causes memory...

PT-2026-116642

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

PT-2026-116778

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on lgr list traversal in smcr port err smcr port err traverses smc lgr list.list without holding smc lgr list.lock, allowing a concurrent smc lgr terminate sched to free an lgr while it is still being dereference...

CVE-2026-98640: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: amdsfh: Validate PCI BAR size before mapping The amdsfh driver maps PCI BAR 2 using pcimiomapregions and subsequently accesses MMIO registers at offsets up to 0x10958 e.g., AMDP2CMSG3 at 0x1068C. However, the driver never...

PT-2026-116728

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer failure virtio gpu execbuffer ioctl reserves a DRM event with drm event reserve init when VIRTGPU EXECBUF RING IDX selects a ring that userspace has enabled polling for...

PT-2026-117027

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcm sysport get stats When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcm sysport get stats. The variable 'j' tracks the compacted index into the...

PT-2026-116817

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6 insert exception for dying fib6 info. Before the cited commit, fib6 nh flush exceptions always set from-exception bucket flushed = 1 under rt6 exception lock to prevent rt6 insert exception from inserting a new...

CVE-2026-112060: Out-of-bounds Write

librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA...

PT-2026-116937

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM before clearing SEV state Explicitly flush caches after intra-host migration before clearing "SEV active" on the source VM, as doing cache maintenance afterwards creates a tiny wind...

PT-2026-116999

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpu discovery sysfs ips allocates ip hw instance with kzalloc flex and initializes its embedded kobject before calling kobject add. If kobject add fails, the retur...

PT-2026-116721

In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alps input configured allocates a second input device "DualPoint Stick" with input allocate device and registers it, but the alps driver struct has no .remove handler a...