PT-2026-73014

In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh-lock for f6i list walks in replace check and notify fib6 check nh list and nexthop replace notify walk nh-f6i list during an RTNL-serialized nexthop replace without holding nh-lock. IPv6 RTM NEWROUTE/RTM DELROUTE...

PT-2026-72651

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb-dev refcnt until after transport finish. However, xfrm rcv cb may modify skb-dev to tunnel dev without taking device reference, such as vti rcv...

PT-2026-73013

In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6i list walk in nh rt cache flush nh rt cache flush walks nh-f6i list during an RTNL-serialized nexthop replace without holding nh-lock, racing the unlocked IPv6 route add/delete that mutate the list unde...

PT-2026-72965

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmb node in loopback attach/detach/unregister dibs lo attach dmb, dibs lo detach dmb and dibs lo unregister dmb look up the dmb node under dmb ht lock, drop the lock and only then operate on the node's...

PT-2026-72961

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free UAF issue exists in the Bluetooth subsystem. The function hci find adv instance returns an adv info pointer that is only valid while hdev-lock is held. However,...

PT-2026-72657

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDR CHANGE rpcrdma cm event handler falls through to the disconnected: label on RDMA CM EVENT ADDR CHANGE and calls rpcrdma ep put with no matching get when the event arrives before RDMA CM EVE...

PT-2026-72964

In the Linux kernel, the following vulnerability has been resolved: audit: fix potential use-after-free in audit del rule audit del rule destroys e-rule.exe via audit remove mark rule before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in aud...

PT-2026-72581

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: don't cache shinfo across skb realloc fbnic tx lso calls skb cow head which may reallocate the skb including the shared info. We can't use the pointer calculated before the call. BUG: KASAN: slab-use-after-free in fbn...

PT-2026-72982

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: hold conn in hci connect big sync callback There is theoretical UAF if the conn is freed while the hci sync task is running. Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to match the...

PT-2026-72599

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: fix use-after-free of DSA ports in crc err work Upon an MDIO CRC error mxl862xx crc err work fn walks the DSA ports and closes the CPU port conduits: dsa switch for each cpu portdp, priv-ds dev closedp-conduit...

PT-2026-72851

In the Linux kernel, the following vulnerability has been resolved: spi: atcspi200: fix use-after-free when driver unbind DMA resource is initialized after SPI controller registration. So when driver unbind, this can trigger a use-after-free when DMA is torn down while the controller is still ali...

PT-2026-72223

In the Linux kernel, the following vulnerability has been resolved: fhandle: reject detached mounts in capable wrt mount The recent fhandle RCU fix moved the mount namespace capability check into capable wrt mount, so a non-NULL mnt namespace survives the ns capable dereference. The helper still...

PT-2026-72471

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Nullify irqfd-producer if updating IRTE for bypass fails Nullify irqfd-producer if updating the IRTE for bypass fails, as leaving a dangling pointer will result in a use-after-free if the irqfd is reachable through KVM'...

PT-2026-72341

In the Linux kernel, the following vulnerability has been resolved: irqchip/crossbar: Use correct index in crossbar domain free crossbar domain free resets the domain data and then uses the nulled out irq data-hwirq member as index to reset the irq map entry and to write the relevant crossbar...

PT-2026-73015

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: hold the RCU lock across ipv6 chk addr in rds tcp laddr check rds tcp laddr check looks up a scoped IPv6 interface with dev get by index rcu, drops the RCU read-side lock, and only then passes the bare struct net device...

PT-2026-72421

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: reacquire gw address after skb realloc The pskb may pull called by batadv bla is backbone gw could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to...

PT-2026-72470

In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvm io bus get dev locking responsibilities to callers kvm io bus get dev returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched device is not the expected...

PT-2026-72410

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svc xprt across the asynchronous TLS handshake callback svc tcp handshake stores the raw svc xprt pointer in tls handshake args.ta data and submits the request through tls server hello x509. The handshake core takes...

PT-2026-72443

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf queue: pin bridge device while NFQUEUE holds fake dst The br netfilter fake rtable is embedded in struct net bridge and is attached to bridged packets with skb dst set noref. If such a packet is queued to NFQUEUE, n...

PT-2026-72476

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling Hyunwoo Kim reports some really bad races should the following situation occur: - LPI-I is pending in vcpu-B's AP list - vcpu-A writes to vcpu-B's ...