PT-2026-116895

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: fix NULL pointer dereference in clkout registration ade9000 setup clkout passes NULL as the register address when registering a divider clock. During clock registration, the common clock framework calls clk...

PT-2026-117010

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AF XDP TX timestamp teardown NULL dereference During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to mlx5e xs...

PT-2026-117064

In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key name mismatch The null key name check exists to protect against TPM reset attacks, so a mismatch should stop the device from serving further requests. Currently it does not disable the chip when it...

PT-2026-117004

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dc state create copy for NULL in dm suspend dc state create copy can return NULL on allocation failure. dm suspend only conditionally skips dm gpureset toggle interrupts and continues execution, returning...

PT-2026-117005

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dc sink dereferences in MST mode validation dm dp mst is port support mode reads aconnector-dc sink-dsc caps... for the DSC branch-throughput check, and get conv frl bw's HDMI-PCON FRL-bandwidth path reads...

CVE-2026-98812: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...

CVE-2026-98764: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix NULL pointer dereference in FUNCTIONFSENDPOINTDESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFSHASFSDESC and the gadget operates at a higher speed such as...

CVE-2026-98791: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AFXDP TX timestamp teardown NULL dereference During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to...

CVE-2026-98795: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5ptpinit returns early on the base lan969x variants because they do not have the SPX5FEATUREPTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the...

CVE-2026-98796: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev eth-dummydev. mtkprobe creates that dummy device, and adds the shared tx/rx NAPI to it, only after...

CVE-2026-98798: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix NULL dereference in setcoalesce before first open The Rx ring priv and index are only set in bcmgenetinitrxring, which runs at open. Setting the Rx coalescing parameters on an interface that was never opened,...

CVE-2026-98854: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered ofoverlayfdtapply stores the idralloc return value in ovcs-id before checking it. On failure the stored id is negative, freeoverlaychangeset's "if ovcs-id" check passes...

PT-2026-117060

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driver data before registering notification handlers Both probe paths register their notification handler before assigning driver data, which the handler dereferences. In the devicetree path, the notification I...

PT-2026-116835

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: reset num napi when the napi vectors are freed fbn-num napi is the count of live napi vectors, each of which owns an IRQ. The PM path had freed them without clearing the count. fbnic pm suspend tears the datapath down...

PT-2026-117014

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5 ptp init returns early on the base lan969x variants because they do not have the SPX5 FEATURE PTP flag. It also returns early when no "ptp" interrupt is described. Unbinding...

PT-2026-117073

In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered of overlay fdt apply stores the idr alloc return value in ovcs-id before checking it. On failure the stored id is negative, free overlay changeset's "if ovcs-id" check...

PT-2026-116812

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debug info copy When debug register static fails, it clears areas, active pages and active entries but leaves the area bounds unchanged. Copying such an area, either by opening its view...

CVE-2026-98637: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure pkvmvcpuinitsve clears KVMARMVCPUSVE in kvm-arch.vcpufeatures when it fails, but vcpuhassve tests KVMARCHFLAGGUESTHASSVE, which is left set. Later vCPUs on that VM...

PT-2026-116907

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL dereference in tb remove work There is a slight race between tb remove work and tb domain remove which leads to dereferencing a NULL tb-root switch pointer inside tb free unplugged xdomains: Thread A Thread ...

PT-2026-116870

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in dat cond set storage key Some callers pass NULL as oldkey. Calling page cond set storage key will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the...