PT-2026-117053

In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails after the user OTP NVMEM device has been registered, mtd otp nvmem add unregisters the user device but leaves mtd-otp user nvmem set. On an error, the...

PT-2026-116971

In the Linux kernel, the following vulnerability has been resolved: tty: port: fix tty port tty vhangup race Drivers rely on tty port tty vhangup to synchronously hang up their ports before tearing down resources as part of deregistration e.g. on physical disconnect. If tty port tty vhangup races...

PT-2026-116984

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronize irq by waiting until its private callback usage counter drops to 0 with the private lock not held. This counter is...

PT-2026-116991

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix port tear down use-after-free Some drivers for multiport devices access port driver data from completion handlers of shared URBs submitted at attach or first open and stopped at disconnect or last close,...

PT-2026-117011

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NF FLOW HW PENDING to NF FLOW PENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nf flow offload stats ca...

PT-2026-117020

In the Linux kernel, the following vulnerability has been resolved: net: restrict SO RESERVE MEM to TCP sockets and cap max value Commit 2bb2f5fb21b0 "net: add new socket option SO RESERVE MEM" and commit d00c8ee31729 "net: fix possible NULL deref in sock reserve memory" only checked sk has...

PT-2026-117026

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/mlx5 module where the mlx5 handle changeupper event and mlx5 handle changeinfodata event functions incorrectly call bonding-specific APIs when handling team...

PT-2026-117039

In the Linux kernel, the following vulnerability has been resolved: blk-mq: set RQF USE SCHED when the operation is known The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQF USE SCHED cleared, so using those flags for a subsequent...

PT-2026-117058

In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste selection In paste selection, the loop copies min tunsigned int, vc sel.buf len - pasted,tty-receive room bytes per iteration into tty ldisc receive buf a...

PT-2026-117073

In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered of overlay fdt apply stores the idr alloc return value in ovcs-id before checking it. On failure the stored id is negative, free overlay changeset's "if ovcs-id" check...

PT-2026-117074

In the Linux kernel, the following vulnerability has been resolved: of/overlay: put property on deadprops only after changeset add succeeds add changeset property links a new property of a not-yet-live target node into the node's deadprops list before handing it to of changeset add property. If...

PT-2026-117076

In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ip vs lblcr new and ip vs lblc new create cache entries for every previously unseen destination address. The table max size only tells the periodic collector to reclaim entries after the...

PT-2026-117078

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: stop the release timer from being rearmed on remove mt remove quiesces the sticky-finger timer before stopping the hardware: timer delete sync&td-release timer; sysfs remove group&hdev-dev.kobj, &mt attribute...

PT-2026-117161

A flaw has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is some unknown functionality of the file App/Home/Controller/VoteController.class.php of the component Vote Handler. This manipulation of the argument...

PT-2026-117029

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211 monitor select queue ieee80211 monitor select queue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However,...

PT-2026-117018

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip detached progs in trampoline images that are still in use bpf tramp image put makes sure a trampoline image is not freed while a task may still be running in it, but nothing similar is done for the progs called by that...

PT-2026-117014

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5 ptp init returns early on the base lan969x variants because they do not have the SPX5 FEATURE PTP flag. It also returns early when no "ptp" interrupt is described. Unbinding...

PT-2026-117033

In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been...

PT-2026-117021

In the Linux kernel, the following vulnerability has been resolved: seg6: ensure packet data is writable before modifying SRH and IPv6 DA advance nextseg modifies the SRH Segments Left field and the IPv6 destination address without ensuring the packet data is writable. seg6 next csid advance arg...

PT-2026-116997

In the Linux kernel, the following vulnerability has been resolved: binder: fix is failure flag for superseded transaction cleanup When a TF UPDATE TXN transaction supersedes a pending async transaction, binder release entire buffer is called with is failure=false. Since the superseded transactio...

PT-2026-117002

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add missing IS ERR check for ovl adaptor platform device platform device register data can fail and return an ERR PTR, but the return value is used without checking, leading to an invalid pointer being stored in ddp...

PT-2026-117005

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dc sink dereferences in MST mode validation dm dp mst is port support mode reads aconnector-dc sink-dsc caps... for the DSC branch-throughput check, and get conv frl bw's HDMI-PCON FRL-bandwidth path reads...

PT-2026-116952

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci core: Serialize fragmented ISO packet queueing The fragmented path in hci queue iso calls skb queue tail without holding conn-data q.lock. The socket lock serializes senders, but the transmit worker can concurrentl...

PT-2026-117022

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix rx Scatter-Gather support When a received frame is larger than dma buf sz, the DMA scatters it across multiple RX descriptors rx Scatter-Gather. The secondary RX buffer sec page was only allocated and programmed...

PT-2026-117034

In the Linux kernel, the following vulnerability has been resolved: nvme: fix cdev lifetime Sashiko bot reported a potential problem for the cdev lifetime in 0 - the code there is heavily based on the NVMe code. Currently the NS head .open and .release file operations methods take and put a...

PT-2026-117008

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in free by rcu ttrace do call rcu ttrace returns early when call rcu ttrace in progress is set and leaves the objects in free by rcu ttrace. free rcu frees waiting for gp ttrace only and clears the flag...

PT-2026-117019

In the Linux kernel, the following vulnerability has been resolved: bpf: Wait for an RCU tasks grace period before freeing trampoline progs When a prog is detached from a trampoline, it is freed after an RCU grace period, or an RCU tasks trace one if it is sleepable. This covers the tasks that ar...

PT-2026-116996

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TF UPDATE TXN supersede When a TF UPDATE TXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree directly. This skips binder free tx...

PT-2026-117003

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: fix firmware leak on teardown The firmware requested in gfx v6 0 init microcode is not released when the GFX block is torn down, leaking the firmware resources. Add gfx v6 0 free microcode and call it from gfx v6...

PT-2026-117016

In the Linux kernel, the following vulnerability has been resolved: net: cap skb-queue mapping when the tx queue is picked skbedit can set skb-queue mapping and raise the per-CPU skip txqueue flag so dev queue xmit honours the mapping. dev queue xmit cleared the flag before sch handle egress and...

PT-2026-117035

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overflow of jump offset in constant blinding bpf jit blind insn rewrites 'if rX op imm goto off' into: AX = imm ^ rnd AX ^= rnd if rX op AX goto off and subtracts 2 from off when the jump is backward. off is s16, so -327...

PT-2026-117027

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcm sysport get stats When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcm sysport get stats. The variable 'j' tracks the compacted index into the...

PT-2026-116990

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierra ms: reject short SWoC info transfers sierra get swoc info requests sizeofstruct swoc info 60 bytes from the device via usb control msg, but its callers only treat a negative return value as failure. A device...

PT-2026-117042

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: preserve hidden-group beacon IE ownership A hidden-group probe-response entry borrows its beacon IEs from the group's beacon entry. cfg80211 update assoc bss entry can pass such an entry to cfg80211 update known b...

PT-2026-117004

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dc state create copy for NULL in dm suspend dc state create copy can return NULL on allocation failure. dm suspend only conditionally skips dm gpureset toggle interrupts and continues execution, returning...

PT-2026-117028

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: don't drain cmd sync backlog on unregister hci unregister dev disables cmd work and cmd timer, then calls hci cmd sync clear, whose cancel work sync waits for hci cmd sync work to return. That worker dequeues...

PT-2026-116992

In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in port shutdown if disconnected acm port shutdown is called from the tty-port machinery whenever the last user closes the port. acm disconnect sets acm-disconnected and calls tty port tty vhangup,...

PT-2026-116999

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpu discovery sysfs ips allocates ip hw instance with kzalloc flex and initializes its embedded kobject before calling kobject add. If kobject add fails, the retur...

PT-2026-117015

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk eth soc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev eth-dummy dev. mtk probe creates that dummy device, and adds the shared tx/rx NAPI to it, only...

PT-2026-117031

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctp dev only after it is initialised mctp add dev links the new mctp dev into dev-mctp ptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a net device pointer...

PT-2026-116998

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ACP MFD device leak on init failure acp hw init registers ACP child devices with mfd add devices before attaching them to the ACP power domain and initializing the hardware. If attaching a child to the power domai...

PT-2026-116748

In the Linux kernel, the following vulnerability has been resolved: gpio: arizona: Fix runtime PM leak in arizona gpio direction out Switching a persistent GPIO line from input to output acquires a runtime PM reference on the parent device, but if the subsequent regmap update bits fails the...

PT-2026-117055

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: reject oversized playback packets Each playback URB is handed a slice of out.buffer that is exactly LINE6 ISO PACKETS max packet size out bytes, sized from the OUT endpoint, but the number of bytes written into that...

PT-2026-117071

In the Linux kernel, the following vulnerability has been resolved: net: extend IPv6 exthdr detection of tunneled packets Commit c4336a07eb6b "net: correctly handle tunneled traffic on IPV6 CSUM GSO fallback" split skb gso has extension hdr into mutually exclusive branches on skb-encapsulation...

PT-2026-117041

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prevent AP VLAN tx from other interfaces Since the station lookup was factored out of ieee80211 build hdr, ieee80211 lookup ra sta uses sta info get bss for all AP and AP VLAN frames, not only for control port...

PT-2026-116808

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject pkt arguments in mutating subprogs The verifier tracks changes in how PTR TO PACKET registers' bounds are modified across subprog boundaries. PTR TO PACKET registers are actually passed as PTR TO MEM, which is assumed...

PT-2026-116824

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach When the Exynos DSI driver was generalized into samsung-dsim, the TE GPIO acquisition was switched from gpiod get optional to devm gpiod get optional while keeping th...

PT-2026-116789

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dst dev overhead The seg6, ioam6 and rpl lwtunnels size their skb cow head request as the length they are about to push plus dst dev overhead, then push the new headers and rebuild the m...

PT-2026-116778

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on lgr list traversal in smcr port err smcr port err traverses smc lgr list.list without holding smc lgr list.lock, allowing a concurrent smc lgr terminate sched to free an lgr while it is still being dereference...

PT-2026-116754

In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in read dts node of clk get returns a clock with its reference count incremented, but read dts node only uses it to read the rate and never calls clk put. The clock is not stored anywhere, so the...