PT-2026-72493

In the Linux kernel, the following vulnerability has been resolved: VDUSE: avoid leaking information to userspace The bounceing is not necessarily page aligned, so current VDUSE can leak kernel information through mapping bounce pages to userspace. Allocate bounce pages with GFP ZERO to avoid...

PT-2026-72452

In the Linux kernel, the following vulnerability has been resolved: fbdev: tridentfb: fix potential memory leak in trident pci probe In trident pci probe, the memory allocated for modelist using fb videomode to modelist is not freed in subsequent error paths. Fix that by calling fb destroy modeli...

PT-2026-72682

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Replace waitqueue and flag with completion The driver previously used a waitqueue along with an explicit request done flag, but without proper barriers around request done. An earlier patch by Gui-Dong Han attempted t...

PT-2026-72804

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12k wifi7 dp rx h verify tkip mic In ath12k wifi7 dp rx h verify tkip mic, the call to ath12k dp rx check nwifi hdr len valid may return false when the NWIFI header length is invalid, causing t...

PT-2026-72529

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix publication race for priv-channel stats mlx5e channel stats alloc publishes a new entry to priv-channel stats and then increments priv-stats nch as a publication token, but neither store carries any memory barrier:...

PT-2026-72366

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: always put unsuccessfully committed target pids damon commit target puts and gets the destination and the source target pids. It puts the destination target pid because it will be overwritten by the source target...

PT-2026-72717

In the Linux kernel, the following vulnerability has been resolved: tipc: reject inverted service ranges from peer bindings tipc update nametbl inserts a binding advertised by a peer node using the lower and upper service-range bounds taken directly from the wire, without checking that lower uppe...

PT-2026-72326

In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: fix error handling in ioctl When gntdev ioctl map grant ref fails to copy the operation result back to userspace after successfully adding the mapping to the list, the error path returns -EFAULT without releasing the...

PT-2026-72559

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFS VOLUME RM TREE is set on Fix afs insert volume into cell to set AFS VOLUME RM TREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volum...

PT-2026-72892

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xe exec ioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs,...

PT-2026-72527

In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on build skb failure qede rx build skb and qede tpa rx build skb do not check for a NULL return from qede build skb. When it returns NULL under memory pressure, the functions still...

PT-2026-72406

In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm file refcount leak on cached nlm do fopen failure The cached-file path in nlm lookup file reaches the found: label unconditionally, even when nlm do fopen fails. At that label result and file-f count are updated...

PT-2026-72498

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2 ioctl query info validates the PASSTHRU FSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bound...

PT-2026-72190

In the Linux kernel, the following vulnerability has been resolved: memstick: ms block: reject a card that reports too many blocks msb ftl initialize computes the zone count from the card block count with no bound: msb-zone count = msb-block count / MS BLOCKS IN ZONE; ... for i = 0; i zone count;...

PT-2026-72543

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix barriering when walking subrequest list Fix the barriering used when walking the subrequest list in retry as there's a possibility of seeing a subreq that's just been added by the application thread...

PT-2026-72509

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential memory leaks in igmp mod timer and igmp stop timer When a timer is deleted and not re-armed in igmp mod timer, or stopped in igmp stop timer, the code currently decrements the reference counter of the...

PT-2026-72462

In the Linux kernel, the following vulnerability has been resolved: fbdev: hecubafb: fix potential memory leak in hecubafb probe The memory allocated for pagerefs in fb deferred io init is not freed on the error path. Fix it by calling fb deferred io cleanup...

PT-2026-72457

In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: fix potential memory leak in uvesafb probe Due to an incorrect goto label, memory allocated for modedb and modelist in uvesafb vbe init is not freed in some error paths. Fix this by updating the goto label...

PT-2026-72228

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix potential memory leak in bnx2x alloc mem bp If the allocation of fpi.tpa info fails, the error path will not free the struct bnx2x fastpath allocated earlier, as it is not linked to the bp structure yet. Fix that by...

PT-2026-72173

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the device property component where the fwnode init function fails to initialize all fields of the fwnode handle structure. When a firmware node is allocated on the...