200611 matches found
PT-2026-72244
In the Linux kernel, the following vulnerability has been resolved: net: ip6 vti: require CAP NET ADMIN in the device netns for changelink vti6 changelink operates on at most two netns, dev netdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other...
PT-2026-72209
In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ip vs seq structs in ip vs conn new Commit 9a05475cebdd "ipvs: avoid kmem cache zalloc in ip vs conn new" changed ip vs conn new to allocate an ip vs conn object with kmem cache alloc. The function then initializ...
PT-2026-72230
In the Linux kernel, the following vulnerability has been resolved: espintcp: use sk msg free partial to fix partial send sk msg free partial ensures consistency of the skmsg at every iteration, without having to manually handle uncharges and offsets. This simplifies the code, and fixes some bugs...
PT-2026-72222
In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fill from part fill from part computes the size of a directory entry in size t but stores it in a u32. An entry length near U32 MAX wraps it to a small value, bypasses the bounds...
PT-2026-72239
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Free BPID bitmap on setup failure nix setup bpids allocates bp-bpids with rvu alloc bitmap, which uses a plain kcalloc. If any of the following devm kcalloc allocations for the BPID mapping arrays fails, the functio...
PT-2026-72235
In the Linux kernel, the following vulnerability has been resolved: gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath programs a per-buffer-queue-descriptor header buf addr at post time and reads the split header back at completion time. Both the post and the read...
PT-2026-72226
In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Initialize eth syslock spinlock before use lan743x hardware init calls pci11x1x strap get status during the PCI11x1x probe sequence. That helper acquires the Ethernet subsystem hardware lock via lan743x hs syslock...
PT-2026-72236
In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210 test int driver write and ca8210 test int user read exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as the byte count to kfif...
PT-2026-72243
In the Linux kernel, the following vulnerability has been resolved: net: ip vti: require CAP NET ADMIN in the device netns for changelink vti changelink operates on at most two netns, dev netdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other...
PT-2026-72218
In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: bound device offsets in the MUX downlink decoder mux dl adb decode walks a chain of aggregated datagram tables using offsets and lengths taken from the modem. first table index, next table index, table length,...
PT-2026-72252
In the Linux kernel, the following vulnerability has been resolved: gpio: tegra: do not call pinctrl for GPIO direction tegra gpio direction input and tegra gpio direction output already program the GPIO controller direction registers directly. The additional pinctrl gpio direction input/output...
PT-2026-72213
In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local-interfaces under RCU. The bulk hardware teardown path removes entries with list del, so an asynchronous transmit completion can...
PT-2026-72221
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, fix matcher leak on resize target setup failure hws bwc matcher move allocates a replacement matcher before setting it as the resize target. If mlx5hws matcher resize set target fails, the replacement matcher is no...
PT-2026-72258
In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rt spin unlock rt spin unlock releases the RCU protection before unlocking the lock. That opens the door for the following UAF scenario: T1 T2 spin lock&p-lock; rcu read lock;...
PT-2026-72245
In the Linux kernel, the following vulnerability has been resolved: net: ena: clean up XDP TX queues when regular TX setup fails create queues with size backoff creates XDP TX queues before setting up the regular TX path. If the subsequent allocation or creation of regular TX queues fails, the...
PT-2026-72224
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch taprio: Replace direct dequeue call with peek and qdisc dequeue peeked When taprio's software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gso skb; taprio dequeue from txq...
PT-2026-72192
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmf notify auth frame rx takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmt frame len =...
PT-2026-72207
In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in move data The loopback move data performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory...
PT-2026-72170
In the Linux kernel, the following vulnerability has been resolved: binder: cache secctx size before release zeroes it binder transaction bounds the scatter-gather buffer area with sg buf end offset and subtracts the aligned LSM context size because the secctx is written at the tail of that area...
PT-2026-72167
In the Linux kernel, the following vulnerability has been resolved: liveupdate: validate session type before performing operation The sessions ioctls are not applicable to all session types. PRESERVE FD is only applicable to outgoing sessions. RETRIEVE FD and FINISH are only valid for incoming...
PT-2026-72191
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbt parse firmware copies patch length - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction...
PT-2026-72179
In the Linux kernel, the following vulnerability has been resolved: mtd: mchp23k256: use SPI match data for chip caps The driver stores chip capacity information in both the OF match table and the SPI id table. Probe currently uses of device get match data, so a non-OF SPI modalias match falls ba...
PT-2026-72208
In the Linux kernel, the following vulnerability has been resolved: macsec: don't read an unset MAC header in macsec encrypt macsec encrypt reads the Ethernet header via eth hdrskb skb-head + skb-mac header to memmove the 12 source/destination MAC bytes forward and make room for the SecTAG. On th...
PT-2026-72196
In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx: Fix i.MX8MP VC8000E power up sequence Per errata1: ERR050531: VPU NOC power down handshake may hang during VC8000E/VPUMIX power up/down cycling. Description: VC8000E reset de-assertion edge and AXI clock may have a...
PT-2026-72175
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: use pm runtime resume and get in suspend Replace pm runtime get sync with pm runtime resume and get to simplify error handling. pm runtime resume and get automatically drops the usage counter on failure,...
PT-2026-72182
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...
PT-2026-72386
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTFS driver where the shared lookup-time attribute validator fails to reject non-resident records for certain resident-only attribute types. This creates...
PT-2026-72402
In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-battery: Fix missing nvmem device put causing reference leak In cpcap battery detect battery type, the reference to an nvmem device obtained via nvmem device find is not released with nvmem device put on the...
PT-2026-72396
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTFS driver where the system fails to verify if there is sufficient space in the Extended Attribute EA entry before accessing the next entry offset field. This...
PT-2026-72365
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: fix dir put orders in access pattern add dirs Patch series "mm/damon/sysfs-schemes: fix wrong directories put orders in error paths". Error paths of damon sysfs access pattern add dirs and damon sysfs sche...
PT-2026-72377
In the Linux kernel, the following vulnerability has been resolved: ntfs: fail attrlist updates when the superblock is inactive generic shutdown super clears SB ACTIVE before evicting cached inodes. If eviction selects the fake inode for a base inode's unnamed $ATTRIBUTE LIST attribute, ntfs evic...
PT-2026-72380
In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound to move in indx insert into root before hdr insert head indx insert into root promotes a full resident $INDEX ROOT into $INDEX ALLOCATION and copies all non-last resident root entries into a newly allocated INDEX...
PT-2026-72329
In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 IRQ SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next...
PT-2026-72320
In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Prevent shared tags across queues on Apple A11 On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag...
PT-2026-72316
In the Linux kernel, the following vulnerability has been resolved: netdev-genl: report NAPI thread PID in the caller's pid namespace netdev nl napi fill one reports the NAPI kthread PID in NETDEV A NAPI PID using task pid nr, which returns the PID in the initial pid namespace. NETDEV CMD NAPI GE...
PT-2026-72583
In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix passing events to regulator core Sashiko reports: Commit 754bd2b4a084 "hwmon: pmbus/core Protect regulator operations with mutex" introduced a worker to batch regulator events over time using atomic or. The delay...
PT-2026-72553
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix writethrough to use collection offload Fix writethrough write to set NETFS RREQ OFFLOAD COLLECTION on the request so that collection is processed asynchronously rather than only right at the end - and also so that...
PT-2026-72550
In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Fix NULL pointer dereference in xe pt zap ptes entry The page-table walk framework may pass a NULL child pointer for unpopulated entries. xe pt zap ptes entry called container ofchild before checking for NULL, then...
PT-2026-72519
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix VMA access race aie2 populate range and amdxdna umap release access a saved VMA pointer that may have already been freed, leading to a potential use-after-free. Remove the VMA accesses from these functions to...
PT-2026-72517
In the Linux kernel, the following vulnerability has been resolved: net/liquidio: drop cached VF pci dev LUT The PF SR-IOV enable path caches VF pci dev pointers in dpiring to vfpcidev lut by iterating with pci get device. Those entries do not own a reference, because the iterator drops the...
PT-2026-72520
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Prevent PM resume deadlock in hwctx sync debug bo amdxdna hwctx sync debug bo invokes the hardware hwctx sync debug bo callback while holding xdna-dev lock. The callback may call amdxdna cmd submit, which in turn...
PT-2026-72536
In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop The ah, hbh and rt matches check that the fixed extension header is present, then use the header length field to derive the advertised extension header lengt...
PT-2026-72511
In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmp gq start timer A race condition exists between device teardown inetdev destroy and incoming IGMP query processing igmp rcv, leading to a Use-After-Free in the IGMP timer callback. During devi...
PT-2026-72505
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpc clnt across the TLS connect worker The TLS connect path has a use-after-free: nothing pins the upper rpc clnt across the delayed connect worker. xs connect stores task-tk client in sock xprt::clnt as a raw...
PT-2026-72475
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks Move the off-by-default consistency check for vmcs12.tpr threshold vs. the virtual APIC vTPR into the "normal" controls checks, as waiting until KVM ha...
PT-2026-72652
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdma wc receive decrements the transport's Receive count for every completion before it dispatches a successful Receive to rpcrdma reply handler. The handler must post a...
PT-2026-72628
In the Linux kernel, the following vulnerability has been resolved: md/raid1: fix writes pending and barrier reference leaks on write failures raid1 make request acquires a writes pending reference with md write start before calling raid1 write request. Several failure paths in raid1 write reques...
PT-2026-72644
In the Linux kernel, the following vulnerability has been resolved: apparmor: release exe file resources on path failure get current exe path takes both an exe file reference and a path reference before resolving the path name. If aa path name failed, it returned immediately and leaked both...
PT-2026-72504
In the Linux kernel, the following vulnerability has been resolved: dm era: fix NULL pointer dereference in metadata open metadata open returns NULL when kzalloc obj fails, but the caller era ctr only checks IS ERRmd. Since IS ERRNULL returns false, the NULL pointer is treated as a valid result a...
PT-2026-72496
In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw sp port lag join When mlxsw sp port lag index get fails, mlxsw sp port lag join returns an error without releasing the lag reference obtained by the earlier mlxsw sp lag get. All other error path...