PT-2026-95087

Name of the Vulnerable Software and Affected Versions dd-trace-cpp versions prior to 2.1.0 Description The library parses incoming W3C baggage headers without enforcing the DD TRACE BAGGAGE MAX ITEMS or DD TRACE BAGGAGE MAX BYTES limits during the extraction path. A remote unauthenticated attacke...

PT-2026-94557

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock can occur when unregistering an s390dbf debug area while an associated debugfs file is being written to. This happens because the debug unregister function attempts to acquire...

PT-2026-94602

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the Bluetooth subsystem when adv timeout expire passes a memory instance allocated via kmalloc to hci cmd sync queue without a destroy callback. This leads to...

PT-2026-94628

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL-dereference issue exists in the qmp-usb component of the qcom phy driver. A crash can occur during early runtime suspend if the runtime suspend callback executes after pm runtime...

PT-2026-94732

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The folio batch mechanism used for iomap zero range fails to release the batch during specific error scenarios. This occurs when calls to the -iomap begin or -iomap end functions fail,...

PT-2026-94749

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the md personalities that can block internally, where the support for REQ NOWAIT is incomplete. While read operations can avoid certain blocking paths, write requests...

PT-2026-94751

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rtlwifi PCI component where the rtl pci probe function contains an incorrect goto label in its final error path. This causes the system to skip necessary cleanup...

PT-2026-94788

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SCSI UFS core where string descriptors are not properly validated. The utf16s to utf8s function expects a count of UTF-16 code units rather than bytes. Because the...

PT-2026-94799

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm scmi firmware component where the scmi protocol table register function fails to properly roll back registrations. When a later entry in an ID table fails,...

PT-2026-94808

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ext4 file system when handling inline data writes. A concurrent thread, such as ext4 page mkwrite, can convert inline data to an extent between the write...

PT-2026-94858

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use after free issue exists in the a6xx gpu init function. The a6xx destroy function frees the a6xx gpu object, causing the adreno gpu pointer to reference memory that has already been...

PT-2026-94877

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap out-of-bounds write exists in the cxlctl get feature function. The issue occurs because the output buffer is sized based on the fwctl rpc.out len value provided by the user, while...

PT-2026-94910

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the san probe function when installing the GSBUS address space handler. This happens because the function dereferences the result of ACPI COMPANION...

PT-2026-94922

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak occurs in the remoteproc: qcom q6v5 adsp component. The issue arises within the adsp map carveout function, which fails to call of node put to release the device node...

PT-2026-94987

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The smack msg queue msgrcv function incorrectly validates permissions by checking the current task instead of the target task. During the msgsnd syscall path, the pipelined send...

PT-2026-94525

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem regarding atomic Read-Modify-Write RMW verification. The system only records the instruction pointer type when the destination...

PT-2026-94473

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A request buffer leak exists in the asynchronous read path of the SMB client. The function smb2 new read req allocates a request buffer using smb2 plain req init, but fails to release th...

PT-2026-94575

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvme/ioctl component where the NVME IOCTL SUBMIT IO endpoint does not utilize the nvme cmd allowed function. This allows unprivileged users to perform I/O operatio...

PT-2026-94622

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An underflow issue exists in the coresight etm4x component. The problem occurs during the initialization or setting of TRCSEQEVR when the TRCIDR5.NUMSEQSTATE is 0b000, as the code uses...

PT-2026-94632

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the firmware loader where fw load sysfs fallback calls device add before adding fw priv to pending fw head. This allows a userspace helper to complete the request via...

PT-2026-94714

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7996 driver where the mt7996 mcu beacon cntdwn function emits two bss bcn cntdwn tlv entries during an active CSA countdown, but the MT7996 BEACON UPDATE SIZE on...

PT-2026-94812

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the int3400 thermal driver where the evaluate odvp function creates per-ODVP sysfs files before the thermal zone and other probe resources are registered. Because the...

PT-2026-94839

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the dw-edma component of the dmaengine. The function dw edma abort interrupt releases the vc.lock before updating the request and status. This allows the issue...

PT-2026-94843

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bpf arena free pages function where scalar arena addresses are processed by masking the address to the low 32 bits and reconstructing a full user address from the...

PT-2026-94852

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the UIO Userspace I/O subsystem where a stale pointer is maintained during a failed registration path. After the device add function is called, the UIO device becomes...

PT-2026-94854

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f uac1 legacy USB gadget driver where the UAC1 STR ATTRIBUTE macro defines configfs show/store handlers for the fn play, fn cap, and fn cntl string options. The...

PT-2026-94890

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ath12k wifi driver where the ath12k mac vdev create function for an AP vdev can lead to a use-after-free condition. When a step following ath12k peer create fails,...

PT-2026-94898

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA hfi1 driver where the hfi1 init dd function allocates shared AIP/VNIC RX support. If the hfi1 init or hfi1 register ib device functions subsequently fail, the...

PT-2026-94902

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the crash dump component where the restore dm crypt keys to thread keyring function incorrectly manages the reference to the user keyring. When restoring multiple...

PT-2026-94913

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the USB subsystem. This occurs when a probe operation runs concurrently with the removal of dynamic IDs. Because dynamic IDs are only guaranteed to b...

PT-2026-94947

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A resource leak occurs in the nvmet-rdma module when an NVMe target using RDMA transport is removed while I/O operations are in flight. In this scenario, a response may be posted, but th...

PT-2026-94951

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the register aes algs function where the AEAD algorithms are registered before the skcipher algorithms. If the skcipher registration fails, the function attempts to...

PT-2026-94974

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu/pm/powerplay component where vddInd and vddcInd fields from VBIOS-parsed tables are used to index into voltage lookup tables without a proper bounds...

PT-2026-94478

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vdpa sim component where the vdpasim create function leaves vdpasim-worker as an ERR PTR an error pointer if kthread run worker fails. The subsequent error path...

PT-2026-94537

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the null blk driver where configfs register subsystem is called before register blkdev in the null init function. When null blk is used as a module, a race condition...

PT-2026-94627

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the raid5 bitmap sector map function where the array range is incorrectly aligned to full RAID5 stripe widths before conversion to component sectors. This occurs becau...

PT-2026-94633

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the scsi qla2xxx driver, the qla2x00 sysfs read vpd function performs a redundant call to ha-isp ops-read optrom. This second call occurs after the optrom mutex has been released, whi...

PT-2026-94644

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cpufreq imx6q driver where imx6 soc volt is allocated using devm kcalloc against the CPU device obtained from get cpu device0. Because this CPU device is never...

PT-2026-94651

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the show pte function when CONFIG DEBUG USER=y and the user debug=31 command line option is enabled. This occurs because a user fault can trigger show pt...

PT-2026-94675

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the pep getsockopt function where the system fails to properly bound the amount of data written to the user buffer. While the function uses min t to clamp the reported...

PT-2026-94705

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7915 driver of the mt76 wifi module where a Target Wake Time TWT flow is added to dev-twt list before the agreement is sent to the firmware. If the MCU rejects t...

PT-2026-94765

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/cxgb4 component where the write tpt entry function fails to properly manage the preallocated skb socket buffer during fatal error states or allocation failure...

PT-2026-94774

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tegra241 cmdqv remove function where VINTFs are torn down before the error IRQ is freed. This sequence creates a window where the tegra241 cmdqv isr function can...

PT-2026-94779

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the remoteproc component due to a lack of synchronization between the rproc crash handler work function and the rproc del function. This allows a driver ...

PT-2026-94791

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the liveupdate component where the system fails to record the status of failed retrieve attempts on a First Level Buffer FLB. When the luo flb retrieve one function...

PT-2026-94801

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.6.0-0010.rc1.ctl4 Description A kernel NULL pointer dereference occurs when the amd pstate ut driver is loaded via modprobe on non-AMD platforms, such as Intel platforms. This issue is triggered within the amd pstate ut...

PT-2026-94851

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write occurs in the help init function when building the letter offsets array. The function uses the first byte of each function name as an index via the calculation sta...

PT-2026-94884

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm scmi firmware component where the scmi cleanup channels function iterates through TX/RX channel IDRs using idr for each to free transport resources and destroy...

PT-2026-94900

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the RDMA/rvt component. The rvt alloc device function deallocates the IB device when the port array allocation fails, but it continues to return the...

PT-2026-94932

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A device reference count leak exists during MHI device creation. The function mhi ep create device allocates references for the UL and DL channels; however, if dev set name or device add...