PT-2026-72357

In the Linux kernel, the following vulnerability has been resolved: kho: make sure scratch size is always aligned by CMA MIN ALIGNMENT BYTES When using scratch scale, the scratch sizes are rounded up to CMA MIN ALIGNMENT BYTES since they will be released as MIGRATE CMA. This is not done when usin...

PT-2026-72360

In the Linux kernel, the following vulnerability has been resolved: mm/mm init: fix uninitialized struct pages for ZONE DEVICE If DAX memory is hotplugged into an unoccupied subsection of an early section, section activate reuses the unoptimized boot memmap. However, compound nr pages still assum...

PT-2026-72328

In the Linux kernel, the following vulnerability has been resolved: i2c: mlxbf: Fix use-after-free in mlxbf i2c init resource If devm platform get and ioremap resource returns an error, mlxbf i2c init resource frees tmp res before reading tmp res-io to get the error code. This results in a...

PT-2026-72331

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Restore SST-PP control to all domains The SST-PP control offset is only restored to power domain 0 after resume. During suspend, control values are read and stored for all power domains. Use pd info-sst base...

PT-2026-72309

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu list annotations and operations sashiko-bot remarked the missing use of list add rcu in bcm rx|tx setup to have a proper initialized bcm op structure when bcm proc show traverses the bcm op's under rcu...

PT-2026-72334

In the Linux kernel, the following vulnerability has been resolved: dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Once the interrupt is requested, the interrupt handler may run immediately. Since the IRQ handler can access channel-ch base, which is initialized only aft...

PT-2026-72338

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the xprt create args structure is allocated on the stack without initialization within the rpc sysfs xprt switch add xprt store function. Although some fields are...

PT-2026-72532

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable mlx5 lag get dev seq will return error when the peer isn't in the LAG or when no device is marked as master. Result bad memory access and kernel crash1. Hence, ski...

PT-2026-72475

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks Move the off-by-default consistency check for vmcs12.tpr threshold vs. the virtual APIC vTPR into the "normal" controls checks, as waiting until KVM ha...

PT-2026-72780

In the Linux kernel, the following vulnerability has been resolved: bpf: Clear rb node linkage when freeing bpf rb root bpf rb root free detaches the root by copying the current rb root cached and then replacing the live root with RB ROOT CACHED. It then walks the copied root and drops each objec...

PT-2026-72833

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5 ib alloc transport domain allocates a transport domain and then may fail in mlx5 ib enable lb. In that case, the allocated TD is leaked. Fix this by...

PT-2026-72615

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix effective prog array index with BPF F PREORDER replace effective prog and purge effective progs located the slot in the effective array by walking the program hlist and counting entries linearly. That count does not matc...

PT-2026-72623

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix order of kfree rcu and rcu assign pointer Sashiko pointed out that kfree rcu was called before rcu assign pointer in handling the comment extension. Fix the order so that rcu assign pointer called first...

PT-2026-72368

In the Linux kernel, the following vulnerability has been resolved: mm/huge memory: preserve pmd swp uffd wp on device-private PMD downgrade change non present huge pmd rewrites a writable device-private PMD swap entry into a readable one without carrying pmd swp uffd wp across. The PTE-level...

PT-2026-72480

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Initialize KVM S390 GET CMMA BITS memory kvm s390 get cmma bits allocates its output buffer with vmalloc, which does not zero the returned pages: values = vmallocargs-count; In the non-peek migration path, dat get cmma...

PT-2026-72625

In the Linux kernel, the following vulnerability has been resolved: md/raid1: free r1 bio when REQ NOWAIT is set and read would block on retry When a read is retried, raid1 read request may be called with a pre-allocated r1 bio. If wait read barrier fails for a REQ NOWAIT read, the bio is complet...

PT-2026-72627

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writes pending leak on write request failures raid10 make request acquires a writes pending reference with md write start before dispatching write requests. Several failure paths in raid10 write request complete th...

PT-2026-72995

In the Linux kernel, the following vulnerability has been resolved: net: udp tunnel: fix memory leak in udp tunnel nic unregister syzbot reported a memory leak 1 in the UDP tunnel NIC offload code. When device registration fails e.g. in register netdevice, netdev core unwinds by sending a single...

PT-2026-72840

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix snp filter reserved mem regions off-by-one Sashiko notes: regarding the bounds check in snp filter reserved mem regions called via walk iomem res desc: does the check if range list-num elements 16 + 8 PAGE SIZE...

PT-2026-72848

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pci get drvdata type in AER handlers rtw88 stores an ieee80211 hw pointer via pci set drvdata at probe time, but io error detected and io resume retrieve it as a net device pointer. This causes netif device...