CVE-2026-72008 pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check Should probe fail for HWVOTER type power domains, this driver was unconditionally trying to perform cleanup for DIRECTCTL domains, but only after checking if the...

CVE-2026-72008

The CVE-2026-72008 entry describes a Mediatek power-domain issue in the Linux kernel where HWV domain probe/cleanup paths could perform power-domain checks incorrectly. Specifically, for HW_VOTER type domains, cleanup for DIRECT_CTL domains ran without confirming the target is powered on, using D...

EUVD-2026-59104

In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00libprobedev uses the full rt2x00libremovedev teardown for all probe failures. However, drvdata allocation and workqueue allocation can fail before intfwork,...

CVE-2026-68462

Summary of CVE-2026-68462 (Linux kernel, BPF): The issue arises in the verifier’s handling of buffer-pointer access (PTR_TO_TP_BUFFER and PTR_TO_BUF) where a constant negative offset could slip through after a pointer offset split (reg->var_off vs reg->off). Specifically, an access with reg...

EUVD-2026-59084

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTRTOTPBUFFER and PTRTOBUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...

CVE-2026-68461 device property: initialize the remaining fields of fwnode_handle in fwnode_init()

In the Linux kernel, the following vulnerability has been resolved: device property: initialize the remaining fields of fwnodehandle in fwnodeinit If a firmware node is allocated on the stack for instance: temporary software node whose life-time we control or on the heap - but using a non-zeroing...

CVE-2026-68462 bpf: Reject negative const offsets for buffer pointers

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTRTOTPBUFFER and PTRTOBUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...

MINI-RGF3-XM45-XWVC

Bulletin has no description...

PT-2026-72217

In the Linux kernel, the following vulnerability has been resolved: riscv: probes: save original sp in rethook trampoline Reading a word from the stack in a kretprobe crashes a risc-v kernel. $ cd /sys/kernel/tracing/ $ echo 'r n tty write $stack0' dynamic events $ echo 1 events/kprobes/enable...

PT-2026-72236

In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210 test int driver write and ca8210 test int user read exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as the byte count to kfif...

PT-2026-72771

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf task from vpid bpf task from vpid looks up a task in the pid namespace of the current task, via find task by vpid: find task by vpidvpid find task by pid nsvpid, task active pid nscurrent...

PT-2026-72550

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Fix NULL pointer dereference in xe pt zap ptes entry The page-table walk framework may pass a NULL child pointer for unpopulated entries. xe pt zap ptes entry called container ofchild before checking for NULL, then...

PT-2026-72335

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma-pcie: Reject devices without driver data dw edma pcie probe treats the PCI device ID driver data as the template for the controller layout and copies it unconditionally. A device bound dynamically via sysfs can...

PT-2026-72351

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL h transaction deref in ocfs2 assure trans credits BUG A direct write over unwritten extents can panic the kernel in ocfs2 assure trans credits when the journal aborts during DIO completion. The crash is a general...

PT-2026-72575

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix potential invalid pointer deref in group process tiler oom If heaps is an ERR PTR, panthor heap pool put will deref an invalid pointer. Make sure we set it to NULL in that case...

PT-2026-72641

In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cache ops-populate callback, and if cache operations include an exit callback, the error code from...

PT-2026-72620

In the Linux kernel, the following vulnerability has been resolved: tpm crb: Check ACPI COMPANION against NULL during probe Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device match driver override, so platform drivers that rely on the...

PT-2026-72699

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: check skb clone in control TX t7xx port ctrl tx clones each skb fragment before passing it to the port transmit path. The clone is used immediately to set cloned-len, so an skb clone failure results in a NULL...

PT-2026-72686

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt re: Avoid displaying the kernel pointer While dumping the info on MR using the rdma tool, we dump the mr hwq which is a kernel pointer. There is no need to expose this value for end user. So avoid it...

PT-2026-72722

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses dev get tstats64 as its ndo get stats64 callback, but pfcp link setup does not request NETDEV PCPU STAT TSTATS. The net core therefore leaves dev-tstats NULL for PFCP...