PT-2026-64480

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fuse req on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server io uring cmd done not call...

PT-2026-64502

In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svc rdma sq wait on sc sq ticket wait or sc send wait can hang indefinitely in TASK UNINTERRUPTIBLE state across transport teardown, pinning svc xprt references...

PT-2026-64671

In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATE MSG can carry a Gap ACK blocks record in its data area. tipc get gap ack blks only verifies that the record's len field is self-consistent with i...

PT-2026-64641

In the Linux kernel, the following vulnerability has been resolved: mfd: cros ec: Delay dev set drvdata until probe success If ec device probe fails, cros ec class release releases memory for the cros ec dev structure. However, because the drvdata was already set, sub-drivers like cros ec typec c...

PT-2026-64656

In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skb queue len readers on audit queue Multiple readers access audit queue.qlen via skb queue len without holding the queue lock or using READ ONCE, while kauditd writes to this field via the skb dequeue →...

PT-2026-64655

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2cap chan timeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading...

PT-2026-64632

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before find table lock update counters and compat update counters forward a user-supplied 32-byte table name to find table lock without NUL-terminating it. On a lookup miss, find inlist...

PT-2026-64644

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ip mc destroy dev iterates through the multicast list and calls ip ma put on each membership, scheduling them for RCU...

PT-2026-64596

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptrace may access with exec update lock FD links proc pid get link and proc pid readlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid...

PT-2026-64612

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the...

PT-2026-64592

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptrace may access with exec update lock part 1 Fix the easy cases where procfs currently calls ptrace may access without exec update lock protection, where the fix is to simply add the extra lock or use mm access: -...

PT-2026-64653

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in log replay copy lcns In the analysis pass of $LogFile journal replay, log replay copies LCNs from each action log record into an existing Dirty Page Table DPT entry without bounding...

PT-2026-64595

In the Linux kernel, the following vulnerability has been resolved: sched/rt: Have RT PUSH IPI be default off for non PREEMPT RT RT migration is done aggressively. When a CPU schedules out a high priority RT task for a lower priority task, it will look to see if there's any RT tasks that are...

PT-2026-64721

In the Linux kernel, the following vulnerability has been resolved: iio: adc: lpc32xx: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "lpc32xx adc probe in drivers/iio/adc/lpc32xx adc.c registers its interrupt handler with devm request irq before it initializes...

PT-2026-64486

In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr entry in fuse resend and fuse remove pending req When fuse resend moves a request from fpq-processing back to fiq-pending, it sets FR PENDING and clears FR SENT but does not remove the requests intr entry from...

PT-2026-64659

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf disable sriov The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state struct adf accel vf info. Currently, adf disable sriov destroys...

PT-2026-64580

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject CLEAN SEGMENTS ioctl with out-of-range segment numbers Syzbot reported a hung task in nilfs transaction begin where multiple tasks performing chmod on a nilfs2 mount blocked for over 143 seconds waiting to acquire ...

PT-2026-64630

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: fix infinite loop in btmtksdio txrx work Every once in a while we see a hung btmtksdio flush task: INFO: task kworker/u17:0:189 blocked for more than 122 seconds. cancel work timer+0x3f4/0x460 cancel work...

PT-2026-64483

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fuse req on io-uring cancel task work When io uring delivers task work with tw.cancel set PF EXITING, PF KTHREAD fallback, or percpu ref is dying on the ring context, fuse uring send in task takes the cancel branc...

PT-2026-64654

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF of hci conn params in add device complete add device complete runs from the hci cmd sync work kworker, which holds only hci req sync lock and not hci dev lock. It calls hci conn params lookup and then...