PT-2026-72690

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSO BY FRAGS 0xFFFF When MTU is large, ip6 default advmss can return IPV6 MAXPLEN 65535. This is interpreted by TCP as mss clamp, allowing the MSS to reach 65535. However, 0xFFFF is...

PT-2026-72643

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to audit log untrustedstring Commit 4a134723f9f1 "apparmor: move check for aa null file to cover all cases" intrdouced a small bug, where path name may pass a potentially uninitialized...

PT-2026-72861

In the Linux kernel, the following vulnerability has been resolved: afs: handle CB.InitCallBackState3 requests without a server record The cache manager callback path now attaches the server record to an incoming call through the rxrpc peer's app data. That association is not guaranteed to exist...

PT-2026-72614

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer spill metadata during half-slot cleanup clean func state cleans dead stack slots in 4-byte halves. When the high half of a STACK SPILL slot is dead and the low half remains live, cleanup converts the live lo...

PT-2026-72823

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with event input event process midi borrows msynth-output rfile.output and then passes the substream to dump midi and snd rawmidi kernel write without synchronizing with the output...

PT-2026-72283

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-fence: Fix potential NULL pointer dereference The commit mentioned in the fixes tag below introduced a mechanism through which fence producers can fully decouple from fence consumers. This, desirable, mechanism is...

PT-2026-72430

In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sk socket dereference in selinux sctp bind connect selinux sctp bind connect dereferences sk-sk socket to pass a struct socket to selinux socket bind and selinux socket connect helper. However, when the hook is...

PT-2026-72607

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf nat: avoid invalid nat net pointer use on failed nf nat init We ran into below KASAN splat, which is mostly uninteresting, beside for having nf nat register fn in the call chain as a cause for the offending access:...

PT-2026-72439

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf nat sip: reload possible stale data pointer quoting sashiko: ------------------------------------------------------------------------ .. noticed a potential memory bug and header corruption involving the SIP NAT...

PT-2026-72351

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL h transaction deref in ocfs2 assure trans credits BUG A direct write over unwritten extents can panic the kernel in ocfs2 assure trans credits when the journal aborts during DIO completion. The crash is a general...

PT-2026-72862

In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afs get tree afs alloc sbi uses kzalloc for memory allocation. And, if ctx-dyn root is not null, as-cell and as-volume are null. In trace afs get tree they are dereferenced. KASAN error messag...

Linux Distros Unpatched Vulnerability : CVE-2026-72253

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfconntracksip: validate skbdst before accessing it tc ingress and openvswitch do not guarantee routing information to be available. These subsystems...

Linux Distros Unpatched Vulnerability : CVE-2026-74359

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - configfslookup: don't leave -sdentry dangling on failure Normally -sdentry is cleared when dentry it's pointing to becomes negative on eviction, realistically...

Linux Distros Unpatched Vulnerability : CVE-2026-74491

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - of/address: Fix NULL bus dereference in ofpcirangeparserone The bus matching rework made ofmatchbus return NULL for nodes with ranges/dma-ranges but no local...

PT-2026-72249

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups icssg ndo get stats64 unconditionally calls emac get stat by name with FW PA stat names regardless of whether the PA stats block is present on the hardware. emac get stat by name...

PT-2026-72897

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DX BIND QUERY without a DX context vmw cmd dx bind query unconditionally dereferences sw context-dx ctx node-ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbu...

PT-2026-73004

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Only report alarms if driver is ready Userspace can read sysfs attributes before driver registration is complete, immediately after devm hwmon device register with info has been called. At that time, data-hwmon dev is...

PT-2026-72678

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtw aes decrypt The null-pointer-guard was incorrect, returning FAIL on valid pointer. Invert the guard, so it returns FAIL on invalid pointer...

PT-2026-72802

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in change sta links for unready link ieee80211 set active links calls ieee80211 link use channel for each newly-added link and WARN ON ONCEs if it fails. The call uses assign on failure=true, which...

PT-2026-72854

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Fix potential tracepoint null pointer dereferences Trace dma fence signaled, trace dma fence wait end and trace dma fence destroy can all currently dereference a null fence-ops pointer after it has been reset on fence...