PT-2026-72949

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode snd usb handle sync urb scales received sync packet sizes by the sender's stride and stores the result directly in out packet-packet sizei. If a connected USB device sen...

PT-2026-72414

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadv tvlv tt vlan data 8 bytes. The size can...

PT-2026-72827

In the Linux kernel, the following vulnerability has been resolved: tracing: Bound synthetic-field strings with seq buf The synthetic field helpers build a prefixed synthetic variable name and a generated hist command in fixed MAX FILTER STR VAL buffers. The current code appends those strings wit...

PT-2026-72742

In the Linux kernel, the following vulnerability has been resolved: vfio/qat: fix f pos race in qat vf resume write qat vf resume write checks filp-f pos before taking migf-lock, but copies into the migration-state buffer after taking the lock and re-reading the shared file position. Two concurre...

Linux Distros Unpatched Vulnerability : CVE-2026-72369

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - minix: avoid overflow in bitmap block count calculation minixchecksuperblock uses minixblocksneeded to verify that the on-disk imap and zmap block counts are...

Linux Distros Unpatched Vulnerability : CVE-2026-72106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0,...

Linux Distros Unpatched Vulnerability : CVE-2026-74488

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex11ndispatchamsdupkt splits an A-MSDU with ieee80211amsduto8023s and walks the...

Linux Distros Unpatched Vulnerability : CVE-2026-74469

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th...

Linux Distros Unpatched Vulnerability : CVE-2026-72470

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/ntfs3: resize log-onepagebuf when adopting on-disk page size logreplay allocates log-onepagebuf using the page size that was chosen from the host PAGESIZE:...

Linux Distros Unpatched Vulnerability : CVE-2026-74443

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/vmwgfx: bound DMA command body size against suffix pointer vmwcmddma locates the DMA suffix at unsigned long &cmd-body + header-size - sizeofsuffix without...

Linux Distros Unpatched Vulnerability : CVE-2026-74391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Bound synthetic-field strings with seqbuf The synthetic field helpers build a prefixed synthetic variable name and a generated hist command in fixed...

PT-2026-72874

In the Linux kernel, the following vulnerability has been resolved: crypto: sun4i-ss - Remove insecure and unused rng alg Remove sun4i ss rng, as it is insecure and unused: - It has multiple vulnerabilities. sun4i ss prng seed is missing locking and has a buffer overflow. sun4i ss prng generate...

PT-2026-72255

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Bound hotplug states sysfs output states show adds CPU hotplug state names into a single sysfs buffer using sprintf. With enough registered states, this can write past the end of the PAGE SIZE buffer. Use sysfs emit...

PT-2026-72174

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTR TO TP BUFFER and PTR TO BUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...

PT-2026-72498

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2 ioctl query info validates the PASSTHRU FSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bound...

PT-2026-72845

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware mac id in link lookup The mac id field in RX descriptors is 8 bits wide 0-255, but assoc link on macid has only RTW89 MAX MAC ID NUM 128 entries. While the driver currently assigns mac id...

PT-2026-72814

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in get srq wqe get srq wqe reads wqe-dma.num sge from the shared receive queue buffer, which is mapped into userspace. It validates num sge against max sge, but then re-reads the same field to...

PT-2026-72405

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdr buf to bvec stores before writing xdr buf to bvec writes a bio vec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When th...

Linux Distros Unpatched Vulnerability : CVE-2026-74460

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in t...

Linux Distros Unpatched Vulnerability : CVE-2026-72066

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cpu: hotplug: Bound hotplug states sysfs output statesshow adds CPU hotplug state names into a single sysfs buffer using sprintf. With enough registered states,...