PT-2026-72272

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core scsi3 emulate pro register and move maps the PERSISTENT RESERVE OUT parameter list with transport kmap data sg and parses the destination TransportID wit...

PT-2026-72738

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci core: Fix UAF in hci unregister dev hci unregister dev does not disable cmd timer and ncmd timer before the hci dev structure is freed. If a timeout fires during device teardown, the callback dereferences freed...

PT-2026-72359

In the Linux kernel, the following vulnerability has been resolved: mtd: slram: remove failed entries from the device list register device links a new slram mtdlist entry before allocating all of the state needed by the entry. If a later allocation, memremap, or mtd device register fails, the...

PT-2026-72315

In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronize rcu in isotp release isotp notify unregisters the RCU CAN filters via can rx unregister and clears so-bound without waiting for a grace period. isotp release uses so-bound to decide wheth...

PT-2026-72786

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate fast symlink target during inode read ocfs2 validate inode block already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same...

PT-2026-72781

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix endpoint/socket association handling Disassociating a socket from an endpoint via siw socket disassoc may release the last reference on that endpoint and free it. Therefore, don't clear the endpoints socket pointer...

PT-2026-72523

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hci add adv monitor publishes a new adv monitor in hdev-adv monitors idr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...

PT-2026-72985

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs kref get unless zero hci conn::iso data is accessed and modified without lock or RCU. This leads to a race Task hdev-workqueue Task 2 iso recv iso conn putconn conn = LOAD hcon-iso data iso co...

PT-2026-72619

In the Linux kernel, the following vulnerability has been resolved: alloc tag: fix use-after-free in /proc/allocinfo after module unload allocinfo start only reinitializes the codetag iterator at position 0. For subsequent reads position 0, it reuses cached iterator state from the previous batch...

PT-2026-72953

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in ump to endpoint create midi2 ump registers a card-owned snd ump endpoint and stores a back-pointer to its per-interface snd usb midi2 ump object in ump-private data, but it never installs an...

PT-2026-72870

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpc recvmsg oob takes a received oob message off recvmsg oobq and, if a response is needed, moves it onto the pending oobq tree. However, only the unlink from recvms...

PT-2026-72578

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch teql: Introduce slaves lock to avoid race condition and UAF The teql master-slaves singly linked list is not protected against multiple writes. It can be mod'ed concurently from teql master xmit, teql dequeue, teql...

PT-2026-72837

In the Linux kernel, the following vulnerability has been resolved: dlm: fix add msg handle in send queue ordered In a benchmark scenario triggering a lot of requests that triggers a lot of DLM messages on the network it can be that the mh-seq is not ordered according the oldest seq number. This...

PT-2026-72944

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtype resize copies comment pointers with memcpy, not the comment objects themselves. During the window after an entry has been copied but before the table swap...

PT-2026-72487

In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tracepoints tipc sk enqueue runs with sk-sk lock.slock held while the socket is owned by user context. The spinlock protects the backlog queue in this path, but it does not serialize...

PT-2026-72974

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in close file table ids A ksmbd file can remain alive after logical close while another session holds a temporary reference obtained through ksmbd lookup fd inode. ksmbd close fd currently marks the file...

PT-2026-72957

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the ALSA 6fire driver. The driver fails to handle a pending USB Request Block URB—a data structure used to manage USB communication—during the error...

PT-2026-72660

In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi-rwsem to protect traversal of the file lock list Lingfeng identified a bug and suggested two solutions, but both appear to have issues. Generally, we cannot release flc lock while iterating over the file lock list t...

PT-2026-72756

In the Linux kernel, the following vulnerability has been resolved: fbdev: sm501fb: Fix buffer errors in OF binding code The code that gets the frame buffer mode from OF has 'use after free', 'buffer overrun' and memory leaks. info-edid data isn't free if the probe functions fail or if pd-def mod...

PT-2026-72664

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free In dma release channel, check chan-device-privatecnt after call dma chan put. However, dma chan put call dma device put which could release the last reference of the device if the DMA provid...