PT-2026-64592

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptrace may access with exec update lock part 1 Fix the easy cases where procfs currently calls ptrace may access without exec update lock protection, where the fix is to simply add the extra lock or use mm access: -...

PT-2026-64595

In the Linux kernel, the following vulnerability has been resolved: sched/rt: Have RT PUSH IPI be default off for non PREEMPT RT RT migration is done aggressively. When a CPU schedules out a high priority RT task for a lower priority task, it will look to see if there's any RT tasks that are...

PT-2026-64596

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptrace may access with exec update lock FD links proc pid get link and proc pid readlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid...

PT-2026-64689

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder free transaction In binder free transaction, the t-to proc is read under the t-lock. However, once the t-lock is dropped, the to proc can die in parallel. This leads to a use-after-free error when we...

PT-2026-64690

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder thread release When a thread exits, binder thread release walks its transaction stack to clear the t-from and t-to proc that correspond with the exiting thread. However, a process dying in parallel might...

PT-2026-64721

In the Linux kernel, the following vulnerability has been resolved: iio: adc: lpc32xx: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "lpc32xx adc probe in drivers/iio/adc/lpc32xx adc.c registers its interrupt handler with devm request irq before it initializes...

PT-2026-64580

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject CLEAN SEGMENTS ioctl with out-of-range segment numbers Syzbot reported a hung task in nilfs transaction begin where multiple tasks performing chmod on a nilfs2 mount blocked for over 143 seconds waiting to acquire ...

PT-2026-64483

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fuse req on io-uring cancel task work When io uring delivers task work with tw.cancel set PF EXITING, PF KTHREAD fallback, or percpu ref is dying on the ring context, fuse uring send in task takes the cancel branc...

PT-2026-64486

In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr entry in fuse resend and fuse remove pending req When fuse resend moves a request from fpq-processing back to fiq-pending, it sets FR PENDING and clears FR SENT but does not remove the requests intr entry from...

PT-2026-64645

In the Linux kernel, the following vulnerability has been resolved: netpoll: fix a use-after-free on shutdown path There is a use-after-free error on netpoll, which is clearly detected by KASAN. BUG: KASAN: slab-use-after-free in raw spin lock irqsave+0x3b/0x80 Read of size 1 at addr ... by task...

PT-2026-64673

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpan nhc do uncompression looks up an NHC descriptor while holding lowpan nhc lock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

PT-2026-64671

In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATE MSG can carry a Gap ACK blocks record in its data area. tipc get gap ack blks only verifies that the record's len field is self-consistent with i...

PT-2026-64670

In the Linux kernel, the following vulnerability has been resolved: staging: vme user: bound slave read/write to the kern buf size The SLAVE-path helpers buffer to user and buffer from user copy 'count' bytes into/out of the fixed-size kern buf size buf == PCI BUF SIZE == 0x20000, 128 KiB using...

PT-2026-64677

In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copy data random recv done stores the device-reported used.len directly into vi-data avail. copy data then indexes vi-data using vi-data idx advanced by previous copy data calls an...

PT-2026-64669

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc0 exemption to responses without data area smb2 check message has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received "server...

PT-2026-64674

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbio disconnect walks usbio-cli list in reverse and uninitializes each auxiliary device. auxiliary device uninit drops the device reference, and for an unbound child that c...

PT-2026-64547

In the Linux kernel, the following vulnerability has been resolved: block: skip sync blockdev on surprise removal in bdev mark dead bdev mark dead's @surprise == true means the device is already gone. The filesystem callback fs bdev mark dead honours this and skips sync filesystem, but the bare...

PT-2026-64480

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fuse req on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server io uring cmd done not call...

PT-2026-64502

In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svc rdma sq wait on sc sq ticket wait or sc send wait can hang indefinitely in TASK UNINTERRUPTIBLE state across transport teardown, pinning svc xprt references...

PT-2026-64706

In the Linux kernel, the following vulnerability has been resolved: ALSA: compress: Fix task creation error unwind snd compr task new allocates the driver task before validating the returned DMA buffers and reserving file descriptors. When either of those later steps fails, the core frees its tas...