PT-2026-72771

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf task from vpid bpf task from vpid looks up a task in the pid namespace of the current task, via find task by vpid: find task by vpidvpid find task by pid nsvpid, task active pid nscurrent...

PT-2026-72225

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch multiq: Replace direct dequeue call with peek and qdisc dequeue peeked multiq dequeue takes a packet from a band's child with a direct -dequeue call after multiq peek peeked it. When the child is non-work-conservin...

PT-2026-72862

In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afs get tree afs alloc sbi uses kzalloc for memory allocation. And, if ctx-dyn root is not null, as-cell and as-volume are null. In trace afs get tree they are dereferenced. KASAN error messag...

PT-2026-72351

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL h transaction deref in ocfs2 assure trans credits BUG A direct write over unwritten extents can panic the kernel in ocfs2 assure trans credits when the journal aborts during DIO completion. The crash is a general...

PT-2026-72699

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: check skb clone in control TX t7xx port ctrl tx clones each skb fragment before passing it to the port transmit path. The clone is used immediately to set cloned-len, so an skb clone failure results in a NULL...

PT-2026-72607

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf nat: avoid invalid nat net pointer use on failed nf nat init We ran into below KASAN splat, which is mostly uninteresting, beside for having nf nat register fn in the call chain as a cause for the offending access:...

PT-2026-72620

In the Linux kernel, the following vulnerability has been resolved: tpm crb: Check ACPI COMPANION against NULL during probe Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device match driver override, so platform drivers that rely on the...

PT-2026-72641

In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cache ops-populate callback, and if cache operations include an exit callback, the error code from...

PT-2026-72702

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch dualpi2: Do not call qdisc tree reduce backlog during peek before restoring qlen Whenever dualpi2 drops packets during peek, it calls qdisc tree reduce backlog. An issue arises because it calls qdisc tree reduce...

PT-2026-72690

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSO BY FRAGS 0xFFFF When MTU is large, ip6 default advmss can return IPV6 MAXPLEN 65535. This is interpreted by TCP as mss clamp, allowing the MSS to reach 65535. However, 0xFFFF is...

PT-2026-72224

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch taprio: Replace direct dequeue call with peek and qdisc dequeue peeked When taprio's software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gso skb; taprio dequeue from txq...

PT-2026-72430

In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sk socket dereference in selinux sctp bind connect selinux sctp bind connect dereferences sk-sk socket to pass a struct socket to selinux socket bind and selinux socket connect helper. However, when the hook is...

PT-2026-72823

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with event input event process midi borrows msynth-output rfile.output and then passes the substream to dump midi and snd rawmidi kernel write without synchronizing with the output...

PT-2026-72335

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma-pcie: Reject devices without driver data dw edma pcie probe treats the PCI device ID driver data as the template for the controller layout and copies it unconditionally. A device bound dynamically via sysfs can...

CVE-2026-72366

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfscreatewritereq to handle async cache object creation netfscreatewritereq will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough...

CVE-2026-72481

In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: ak8975: fix potential kernel stack memory leak Currently in the AK8975 driver there are four instances where potential uninitialized kernel stack memory leaks can occur. If i2csmbusreadi2cblockdataoremulated...

CVE-2026-74290

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsflow: Dont expose folded kernel pointers The flow classifier falls back to addrfold for fields that are missing from packet headers. In map mode, userspace controls mask, xor, rshift, addend and divisor, and can...

CVE-2026-72062

In the Linux kernel, the following vulnerability has been resolved: gpio: mt7621: avoid corruption of shared interrupt trigger state The bank-shared fields like 'rising' and 'falling' are modified using non-atomic read-modify-write operations. Since every gpio chip instance represents an entire...

CVE-2026-72191

In the Linux kernel, the following vulnerability has been resolved: ntfs3: validate split-point offset in indxinsertintobuffer indxinsertintobuffer computes used = used1 - tocopy - spsize; memmovedet, Add2Ptrsp, spsize, used - le32tocpuhdr1-deoff; where sp and spsize come from hdrfindsplit...

CVE-2026-72077

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix firmware leak in async update The firmware object was not being released if validation failed. Use freefirmware to ensure the firmware is always released...