PT-2026-122048

In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added asynchronous route notifications for hardware flag changes. fib alias hw flags set siz...

PT-2026-121981

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 "drm/imagination: Fix page count for page table for map interface" passed the device address to pvr mmu op context create, but the preallocation...

PT-2026-121959

In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount d alloc pseudo hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHE NORCU and dentry free frees them righ...

PT-2026-122023

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the buf state and its attached buffer should be freed. In the case of AF XDP ZC, the XSK buffer was not freed, leading to a...

PT-2026-122029

In the Linux kernel, the following vulnerability has been resolved: selinux: preserve NATIVE LABELS on already-initialized sb in set mnt opts When an NFSv4 filesystem exported with security label is mounted a second time, sget fc returns the existing superblock and nfs get root calls security sb...

PT-2026-121961

In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir, unlink and rename call dont mount on the victim and then detach mounts with the victim's inode locked. do lock mount takes the inode lock of the mountpoint an...

PT-2026-122025

In the Linux kernel, the following vulnerability has been resolved: gve: fix napi disable deadlock when attempting to disable XSK pools When disabling XSK pools, GVE calls the unlocked versions of napi disable and napi enable. However, the netdev lock has already been acquired before ndo bpf is...

PT-2026-121969

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree may copy tree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no...

PT-2026-122007

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb copy and csum bits When skb copy and csum bits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The calle...

PT-2026-122003

In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bc transmit sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but team xmit still returns NETDEV TX OK. ...

PT-2026-122002

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand datapath flows hit a soft lockup inside a single netlink flow dump and panicked. ovs flow cmd dump calls ovs flow stats get f...

PT-2026-122031

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipc topsrv stop closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could...

PT-2026-122014

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: reject the lmk IV mode with AEAD ciphers A "capi:" table line that pairs an AEAD cipher with the lmk IV mode, for example "capi:gcmaes-lmk" with the integrity:28:aead option, causes an oops when it is loaded. lmk sets...

PT-2026-122032

In the Linux kernel, the following vulnerability has been resolved: tcp: reject net iov in zerocopy receive mapping hints After copying a readable prefix, receive fallback to copy asks tcp zerocopy set hint for skb where page mapping can resume. If the next skb is unreadable, find next mappable...

PT-2026-122016

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstick alloc card and memstick set rw addr, wait for completion timeout is used to wait for device identification and address configuration requests to complete...

PT-2026-122013

In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in do resume When do resume calls dm table get modenew map, the call is done without holding any locks it only holds a reference to the md. It may be possible that another concurrent ioctl on the same...

PT-2026-122038

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmf detach When the driver is removed while the user space process that created the P2P device e.g. wpa supplicant is still exiting, the P2P device interface is removed twice and t...

PT-2026-122012

In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req timeout while a request is active. msdc request done uses cancel delayed work, which does not wait for a timeout callback that has already started. The...

PT-2026-121991

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: Fix command skb lifetime during scan setup During PA sync scan setup, hci le set ext scan param sync gets the address used for the PA LINK lookup from hci sent cmd data. The returned pointer borrows storage...

PT-2026-122043

In the Linux kernel, the following vulnerability has been resolved: can: dev: init can skb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skb reset mac header/skb reset network header/ skb reset transport header calls from...

PT-2026-122044

In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix local root reference leak in scrub print warning inode When paths from inode fails, scrub print warning inode jumps to err without dropping the reference taken by btrfs get fs root, leaking a reference to the ro...

PT-2026-121993

In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access access ok checks untagged addruaddr, but arch futex atomic op inuser and futex atomic cmpxchg inatomic hand the raw uaddr to the inline asm amoswap/amoadd/.../lr.w+sc....

PT-2026-121874

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devm pm runtime enable sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pm runtime enable into the removal path instead doing it early. This...

PT-2026-121873

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imx mu isr imx mu shutdown imx mu xcr rmwpriv, IMX MU RCR, 0, IMX MU xCR RIEnpriv-dcfg-type, cp-idx; imx mu...

PT-2026-121872

In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bm seq comparison wrap-safe Once the 32-bit seq wraps, a newer bm seq can look smaller than old, so .. covert to wrap-safe calculate way...

PT-2026-121877

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb write pointer with invalidate lock sb write pointer reads the super block from the block device page cache using read cache page gfp. This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568...

PT-2026-121876

In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966x fdma reload backs up rx-page pool and rx-fdma before reallocating the RX resources for the new MTU. If the allocation fails, the restore path puts these fields back before...

PT-2026-121871

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix lease break and ack state handling Do not skip valid lease states containing WRITE CACHING when breaking level-II/read leases for writes and truncates. Handle lease break acknowledgments according to the SMB2 rule that...

PT-2026-121875

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfd queue acquire buffers was split off from set queue properties from user, set queue properties from criu was missed. Thus, set queue properties from criu is not...

PT-2026-121889

In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack size THREAD SIZE ORDER to 32 kB, in order to avoid kernel crashes which have been triggered recently when building the debian...

PT-2026-121933

In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when io uring read extent fails btrfs uring read extent runs only after btrfs encoded read has taken the inode shared lock and the extent lock. On failure it used to unlock in out fail, an...

PT-2026-121925

In the Linux kernel, the following vulnerability has been resolved: devlink: fix devlink rel reference leak when notify work is pending devlink rel nested in notify work schedule takes a reference on the devlink rel for the notify work and then queues the work, ignoring the return value of schedu...

PT-2026-121924

In the Linux kernel, the following vulnerability has been resolved: pfcp: make sure the SEID is linear before reading it pfcp encap recv only makes sure that the UDP header and the 4 byte PFCP header are in the linear area. When the S flag is set, pfcp session recv then reads the 8 byte SEID that...

PT-2026-121923

In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin user regset copyin only copies count bytes, so a PTRACE SETREGSET request with a short iov len leaves the rest of the stack buffer uninitialized. In riscv vr set that...

PT-2026-121922

In the Linux kernel, the following vulnerability has been resolved: flow dissector: avoid u16 truncation of hlen in bpf flow dissect bpf flow dissect sanitizes the offsets returned by the BPF program with clamp tu16, ..., hlen. If hlen is bigger than 65535, the upper bound is truncated before the...

PT-2026-121928

In the Linux kernel, the following vulnerability has been resolved: ASoC: adau1372: allow sleepy powerdown GPIOs gpiod set value emits a WARN when the GPIO provider indicates that it can sleep, as is typical for I2C controlled GPIO expanders. Since the powerdown GPIO is only manipulated in proces...

PT-2026-121911

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Drop unnecessary PMD page copy when freeing On a box with a discrete GPU, lockdep reports a possible deadlock as soon as kswapd shrinks the TTM page pool. The immediate cause is an x86 commit that added an mmap read lock ...

PT-2026-121909

In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf event open currently gates perf allow kernel only on !attr.exclude kernel. However, users can still request kernel callchain collection with attr.exclude...

PT-2026-121908

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar-num stations on hardware start When multiple hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'num stations' in 'struct ath11k' that did not...

PT-2026-121783

Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security...

PT-2026-121984

In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: defer setup when fbdev probe fails, not just on -EAGAIN drm fb helper initial config and unlock calls drm client modeset probe first, which already fills in each mode set-mode/num connectors for every connected...

PT-2026-122026

In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pm runtime get sync leaves the usage counter incremented even when it fails, and xgpio request returns the error without dropping it. gpiolib does not call -free when -reque...

PT-2026-121956

In the Linux kernel, the following vulnerability has been resolved: namespace: refuse an automount below a mount that is in no namespace It's possible to add autmounts even when the parent mount isn't in the mount namespace of the caller. The only requirement we have is that the parent mount...

PT-2026-121958

In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink, rmdir and rename remove the entry from the filesystem, call detach mounts on the entry with the inode locked and then call d delete once the inode is unlocked...

PT-2026-121957

In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. step into step into rechecks d seq and follow mount rcu rechecks mount lock. An entry that gets unlinked in between caus...

PT-2026-121967

In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrink submounts and mark mounts for expiry first collect all the mounts they are allowed to unmount and then unmount them. Whether a mount is busy is decided ...

PT-2026-121966

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops do loopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own fil...

PT-2026-121965

In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPEN TREE NAMESPACE open treeOPEN TREE NAMESPACE creates a new mount namespace from a copy of the tree at the given path. The caller needs to be privileged over its current user namespace...

PT-2026-121964

In the Linux kernel, the following vulnerability has been resolved: namespace: look at the topmost mount for a mount namespace file attach recursive mnt preallocates a mountpoint for the root of the topmost mount of the source so that a mount that already sits at the destination can be put on top...

PT-2026-122035

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current pwq deref in chained work check current wq worker only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker-current pwq is populated...