PT-2026-94908

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the bpf cpumask populate function uses bitmap copy to write to a destination typed as struct cpumask . This allows the verifier to incorrectly...

PT-2026-94525

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem regarding atomic Read-Modify-Write RMW verification. The system only records the instruction pointer type when the destination...

PT-2026-94602

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the Bluetooth subsystem when adv timeout expire passes a memory instance allocated via kmalloc to hci cmd sync queue without a destroy callback. This leads to...

PT-2026-94595

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A lock leak occurs in the BPF subsystem within the irq work path. The functions stack map get build id offset and bpf find vma use a per-CPU irq work to defer mmap read unlock from the...

PT-2026-94769

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the PCI subsystem. This occurs when a probe runs concurrently with the removal of dynamic IDs, as the remove id store function can free the node whil...

PT-2026-94793

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the trampoline could be corrupted due to the incorrect assignment of tr-flags in the verifier. When a fexit is attached to a tail call reachabl...

PT-2026-94824

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the case statement for BPF RES SPIN LOCK incorrectly validates the offset using the logic intended for BPF SPIN LOCK. Th...

PT-2026-94836

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ad5686 DAC driver within the Industrial I/O IIO subsystem due to a missing NULL check on match data. If a user binds the driver using driver override via sysfs wit...

PT-2026-94852

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the UIO Userspace I/O subsystem where a stale pointer is maintained during a failed registration path. After the device add function is called, the UIO device becomes...

PT-2026-94913

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the USB subsystem. This occurs when a probe operation runs concurrently with the removal of dynamic IDs. Because dynamic IDs are only guaranteed to b...

PT-2026-94940

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the check ptr to btf access function allows btf struct access callbacks to validate write operations before the default...

PT-2026-94545

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the HID haptic subsystem where the fill effect buf function initializes values only for four specific haptic usages. However, it writes these values to field-value for...

PT-2026-94615

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the SCSI subsystem when scsi alloc sgtables fails. The function sd set special bvec allocates a special payload page for UNMAP and WRITE SAME commands. If a...

PT-2026-94616

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An error handling issue exists in the sd probe function within the SCSI subsystem. When sd large pool create fails after device add&sdkp-disk dev has already succeeded, the system fails ...

EUVD-2026-80475

In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: quiesce overflow recovery before freeing streams The VIP overflow recovery worker is armed from the hardirq handler when a FIFO overflow is detected, and the list-complete path looks the stream up through the VPDM...

kernel: fanotify: fix false positive on permission events

A flaw was found in the Linux kernel's fanotify subsystem. This vulnerability allows for a bypass of permission checks because the fsnotifygetmarksafe function may incorrectly return false for marks on unrelated groups. This could enable an attacker to perform unauthorized actions by circumventin...

kernel: crypto: ccp - copy IV using skcipher ivsize

A flaw was found in the Linux kernel's cryptographic coprocessor CCP driver. When processing AFALG rfc3686-ctr-aes-ccp requests, the ccpaescomplete function attempts to restore more data than the allocated buffer for the Initialization Vector IV can hold. This leads to a buffer overrun, which can...

PT-2026-93653

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SPI subsystem where a partial failure during DMA mapping can lead to incorrect ownership of the mapping. Specifically, if an RX mapping fails after a TX mapping...

PT-2026-93397

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Linux kernel's perf subsystem. The problem occurs when a perf mmap revival races with the last munmap. Specifically, the perf mmap close function dro...

PT-2026-93541

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the Consumer Electronics Control CEC core of the media subsystem. The issue stems from a missing call to the rc free device function. Specifically, a previous...