PT-2026-116728

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer failure virtio gpu execbuffer ioctl reserves a DRM event with drm event reserve init when VIRTGPU EXECBUF RING IDX selects a ring that userspace has enabled polling for...

PT-2026-116999

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpu discovery sysfs ips allocates ip hw instance with kzalloc flex and initializes its embedded kobject before calling kobject add. If kobject add fails, the retur...

PT-2026-116721

In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alps input configured allocates a second input device "DualPoint Stick" with input allocate device and registers it, but the alps driver struct has no .remove handler a...

CVE-2026-98842: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: module: fix lost error code from codetagloadmodule If codetagloadmodule fails, err is not set to reflect the failure and loadmodule returns 0 after the module has been torn down. Also, if the module is a livepatch, mod-klpinfo...

CVE-2026-98435: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Use parent device for devres in altrportbsetup Anchor the devres group and the devm-managed IRQ requests in altrportbsetup to the actual parent device device-edac-dev instead of the embedded struct device inside the...

CVE-2026-112012: Out-of-bounds Write

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in ttadecoderprocessstream and ttadecoderprocessframe because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache-1 with...

CVE-2026-98780: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpudiscoverysysfsips allocates iphwinstance with kzallocflex and initializes its embedded kobject before calling kobjectadd. If kobjectadd fails, the return value ...

PT-2026-116669

In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compound send recv waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already...

CVE-2026-98605: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach When the Exynos DSI driver was generalized into samsung-dsim, the TE GPIO acquisition was switched from gpiodgetoptional to devmgpiodgetoptional while keeping the...

PT-2026-116887

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iio push to buffers with ts unaligned leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is...

PT-2026-116875

In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenable work before freeing trigger iio trigger notify done atomic defers -reenable into trig-reenable work on the system workqueue, and the worker dereferences the owning trigger through container of. Nothi...

PT-2026-116979

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec partner desc in tps6598x connect tps6598x connect passes a stack-allocated typec partner desc to typec register partner after initializing only usb pd, accessory and identity. typec...

PT-2026-116890

In the Linux kernel, the following vulnerability has been resolved: iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure If devm thermal of zone register fails, probe returns without unregistering the IIO map array or disabling runtime PM. Jump to err map to release them...

CVE-2026-98773: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in portshutdown if disconnected acmportshutdown is called from the tty-port machinery whenever the last user closes the port. acmdisconnect sets acm-disconnected and calls ttyportttyvhangup, which...

PT-2026-116667

In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM points out that we leak the igrab'd reference to the orphanage directory inode if chowning it fails. Fix that...

CVE-2026-98668: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iiopushtobufferswithtsunaligned leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is enabled...

CVE-2026-98640: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: amdsfh: Validate PCI BAR size before mapping The amdsfh driver maps PCI BAR 2 using pcimiomapregions and subsequently accesses MMIO registers at offsets up to 0x10958 e.g., AMDP2CMSG3 at 0x1068C. However, the driver never...

CVE-2026-98629: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it und...

CVE-2026-98498: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix reventry reference leak in mlx5tcctsharedcounterget When the reverse entry is found but its counter is already being released, refcountincnotzero fails and the reference taken by mlx5tcctentryget is never dropped...

PT-2026-116662

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description An issue exists in the xlog recover iunlink bucket function within the XFS file system of the Linux kernel. The flaw involves improper cursor and pointer handling during the recovery of...