PT-2026-72660

In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi-rwsem to protect traversal of the file lock list Lingfeng identified a bug and suggested two solutions, but both appear to have issues. Generally, we cannot release flc lock while iterating over the file lock list t...

PT-2026-72957

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the ALSA 6fire driver. The driver fails to handle a pending USB Request Block URB—a data structure used to manage USB communication—during the error...

PT-2026-72268

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix use-after-free and double-free in disconnect ims pcu disconnect only intended to perform cleanup when the primary control interface is unbound. However, it currently relies on the interface class to distingui...

PT-2026-72786

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate fast symlink target during inode read ocfs2 validate inode block already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same...

PT-2026-72985

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs kref get unless zero hci conn::iso data is accessed and modified without lock or RCU. This leads to a race Task hdev-workqueue Task 2 iso recv iso conn putconn conn = LOAD hcon-iso data iso co...

PT-2026-72487

In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tracepoints tipc sk enqueue runs with sk-sk lock.slock held while the socket is owned by user context. The spinlock protects the backlog queue in this path, but it does not serialize...

PT-2026-72974

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in close file table ids A ksmbd file can remain alive after logical close while another session holds a temporary reference obtained through ksmbd lookup fd inode. ksmbd close fd currently marks the file...

PT-2026-72693

In the Linux kernel, the following vulnerability has been resolved: sockmap: Fix use-after-free in udp bpf recvmsg syzbot reported use-after-free of struct sk msg in sk msg recvmsg. 0 sk msg recvmsg peeks sk msg from psock-ingress msg under a lock, but its processing is lockless. Thus, sk msg...

PT-2026-72194

In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00lib probe dev uses the full rt2x00lib remove dev teardown for all probe failures. However, drv data allocation and workqueue allocation can fail before intf work,...

PT-2026-72301

In the Linux kernel, the following vulnerability has been resolved: io uring/bpf-ops: reject re-registration of an already-bound ops io install bpf only rejects a second registration on the ctx side ctx-bpf ops and sets the per-map back-pointer ops-priv unconditionally. The struct ops link path...

PT-2026-72593

In the Linux kernel, the following vulnerability has been resolved: net: udp tunnel: prevent double queueing in udp tunnel nic device sync Yue Sun reported a use-after-free and debugobjects warning in udp tunnel nic device sync work during concurrent device operations. The workqueue core clears t...

PT-2026-73016

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt hashlimit: validate hashtable supports XT HASHLIMIT RATE MATCH The XT HASHLIMIT RATE MATCH flag mode changes the semantics of the dsthash ent structure which represents an entry in the hashtable. There is a union ar...

PT-2026-72750

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpf obj free fields when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete...

PT-2026-72260

In the Linux kernel, the following vulnerability has been resolved: tracing/user events: Fix use-after-free in user event mm dup user event mm dup walks the parent mm's enabler list locklessly under rcu read lock during fork from copy process; it does not take event mutex: rcu read lock; list for...

PT-2026-72359

In the Linux kernel, the following vulnerability has been resolved: mtd: slram: remove failed entries from the device list register device links a new slram mtdlist entry before allocating all of the state needed by the entry. If a later allocation, memremap, or mtd device register fails, the...

PT-2026-72738

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci core: Fix UAF in hci unregister dev hci unregister dev does not disable cmd timer and ncmd timer before the hci dev structure is freed. If a timeout fires during device teardown, the callback dereferences freed...

PT-2026-72315

In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronize rcu in isotp release isotp notify unregisters the RCU CAN filters via can rx unregister and clears so-bound without waiting for a grace period. isotp release uses so-bound to decide wheth...

PT-2026-73014

In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh-lock for f6i list walks in replace check and notify fib6 check nh list and nexthop replace notify walk nh-f6i list during an RTNL-serialized nexthop replace without holding nh-lock. IPv6 RTM NEWROUTE/RTM DELROUTE...

PT-2026-72948

In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in fou create fou create publishes struct fou through sk user data before adding the new FOU port to the per-netns list. If fou add to port list fails, the error path frees fou while it is still reachable...

PT-2026-73013

In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6i list walk in nh rt cache flush nh rt cache flush walks nh-f6i list during an RTNL-serialized nexthop replace without holding nh-lock, racing the unlocked IPv6 route add/delete that mutate the list unde...