PT-2026-72464

In the Linux kernel, the following vulnerability has been resolved: fbdev: metronomefb: fix potential memory leak in metronomefb probe The memory allocated for pagerefs in fb deferred io init is not freed on the error path. Fix it by calling fb deferred io cleanup...

PT-2026-72486

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtr endpoint post qrtr endpoint post validates an incoming packet with if !size || len != ALIGNsize, 4 + hdrlen goto err; where size comes from the wire. On 32-bit, size t is 32 bits and...

PT-2026-72461

In the Linux kernel, the following vulnerability has been resolved: fbdev: efifb: fix memory leak in efifb probe Since commit 73ce73c30ba9 "fbdev: Transfer video= option strings to caller; clarify ownership" the string returned from fb get options is expected to be freed by the caller, but the...

PT-2026-72463

In the Linux kernel, the following vulnerability has been resolved: fbdev: broadsheetfb: fix potential memory leak in broadsheetfb probe The memory allocated for pagerefs in fb deferred io init is not freed on the error path. Fix it by calling fb deferred io cleanup...

PT-2026-72474

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs The intra-host migration/mirroring feature is not fully implemented for SEV-SNP VMs. The proper migration requires additional SNP-specific state such as guest req...

PT-2026-72469

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: account pKVM reclaim against the VM mm Protected guest faults charge long term pins to the VM's mm. Teardown can run later from file release, where current-mm may be unrelated. Drop the charge from kvm-mm instead...

PT-2026-72416

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: fix primary if leak on failed linearization If the skb has a frag list, it must be linearized before it can be split using skb split. But when this step failed, it must not only free the skb but also take care o...

PT-2026-72424

In the Linux kernel, the following vulnerability has been resolved: s390/perf cpum cf: Add missing array index nospec to hw perf event init ev variable is userspace controlled via event-attr.config and used as an array index after bounds checking, but without speculation barriers. Add the missing...

PT-2026-72427

In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSR AMD64 SYSCFG SNP EN" Revert 99cf1fb58e68 "x86/virt/sev: Drop WBINVD before setting MSR AMD64 SYSCFG SNP EN". Section 8.8 of the SNP spec says: Before invoking SNP INIT EX with...

PT-2026-72422

In the Linux kernel, the following vulnerability has been resolved: batman-adv: access unicast ttvn skb-data only after skb realloc The pskb may pull called by batadv get vid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid...

PT-2026-72432

In the Linux kernel, the following vulnerability has been resolved: gpu/buddy: bail out of try harder when alignment cannot be honoured The try harder contiguous fallback could return a range whose start offset did not match the caller's min block size. When a candidate's start is misaligned,...

PT-2026-72458

In the Linux kernel, the following vulnerability has been resolved: fbdev: s3fb: fix potential memory leak in s3 pci probe In s3 pci probe, the memory allocated for modelist using fb videomode to modelist is not freed in subsequent error paths. Fix that by calling fb destroy modelist...

PT-2026-72428

In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix reference leak on failed device registration When platform device register fails in sm501 register device, the embedded struct device in pdev has already been initialized by device initialize, but the failure path...

PT-2026-72425

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/brs: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERF SAMPLE BRANCH USER is requested. On...

PT-2026-72423

In the Linux kernel, the following vulnerability has been resolved: batman-adv: retrieve ethhdr after potential skb realloc on RX pskb may pull in batadv interface rx could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

PT-2026-72430

In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sk socket dereference in selinux sctp bind connect selinux sctp bind connect dereferences sk-sk socket to pass a struct socket to selinux socket bind and selinux socket connect helper. However, when the hook is...

PT-2026-72411

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Free arena sub-allocations on discover arenas error path Memory allocated by btt freelist init, btt rtt init, and btt maplocks init is not freed on some discover arenas error paths. This leaks memory when arena...

PT-2026-72439

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf nat sip: reload possible stale data pointer quoting sashiko: ------------------------------------------------------------------------ .. noticed a potential memory bug and header corruption involving the SIP NAT...

PT-2026-72435

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conncount: fix zone comparison in tuple dedup The "already exists" dedup logic in nf conncount add decides whether a connection has already been counted and can be skipped instead of incrementing the connlimit count...

PT-2026-72444

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt cluster: reject template conntracks in hash match xt cluster mt treats any non-NULL nf ct get result as a fully initialized conntrack and passes it to xt cluster hash. This causes a state confusion bug when the raw...

PT-2026-72392

In the Linux kernel, the following vulnerability has been resolved: ntfs: centalize $INDEX ROOT header validation Add a dedicated helper to perform stricter validation of $INDEX ROOT and use it for both directory inodes and named index inodes. This keeps the root size and header geometry checks...

PT-2026-72381

In the Linux kernel, the following vulnerability has been resolved: ntfs3: cap RESTART TABLE free-chain walker at rt-used A crafted NTFS3 disk image triggers an in-kernel infinite loop at mount time, hanging the mounting thread and firing the soft-lockup watchdog within 22s on multi-CPU hosts pan...

PT-2026-72368

In the Linux kernel, the following vulnerability has been resolved: mm/huge memory: preserve pmd swp uffd wp on device-private PMD downgrade change non present huge pmd rewrites a writable device-private PMD swap entry into a readable one without carrying pmd swp uffd wp across. The PTE-level...

PT-2026-72367

In the Linux kernel, the following vulnerability has been resolved: riscv: cacheinfo: Fix node reference leak in populate cache leaves Currently, the while loop drops the reference to prev in each iteration. If the loop terminates early due to a break, the final of node putnp correctly drops the...

PT-2026-72382

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indx find buffer to prevent stack overflow indx find buffer recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded...

PT-2026-72360

In the Linux kernel, the following vulnerability has been resolved: mm/mm init: fix uninitialized struct pages for ZONE DEVICE If DAX memory is hotplugged into an unoccupied subsection of an early section, section activate reuses the unoptimized boot memmap. However, compound nr pages still assum...

PT-2026-72383

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attr off in UpdateResidentValue against data off In do action's UpdateResidentValue case fslog.c:3307, lrh-attr off and lrh-redo len come from the on-disk LRH. When they satisfy aoff + dlen res.data off, the...

PT-2026-72404

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: Fix leak when custom dump segments addition fails Free allocated minidump region 'name' in qcom add minidump segments when failing before adding the region to 'dump segments'. Otherwise, the 'name' is not tracke...

PT-2026-72399

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ntfs ir reparent function where the system updates the index root header before resizing the resident value. When the root stub requires more space than the existi...

PT-2026-72346

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: add bounds check in dfh get param size dfh get param size can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP End of Parameters bit...

PT-2026-72314

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix use-after-free race with concurrent NETDEV UNREGISTER isotp release looked up the bound network device via dev get by index using the stored ifindex. During device unregistration the device is unlisted from the...

PT-2026-72350

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An array-index-out-of-bounds issue exists in the ocfs2 sum rightmost rec function. On-disk corruption that sets the l next free rec variable to 0 in an inode's embedded extent list can...

PT-2026-72309

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu list annotations and operations sashiko-bot remarked the missing use of list add rcu in bcm rx|tx setup to have a proper initialized bcm op structure when bcm proc show traverses the bcm op's under rcu...

PT-2026-72334

In the Linux kernel, the following vulnerability has been resolved: dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Once the interrupt is requested, the interrupt handler may run immediately. Since the IRQ handler can access channel-ch base, which is initialized only aft...

PT-2026-72338

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the xprt create args structure is allocated on the stack without initialization within the rpc sysfs xprt switch add xprt store function. Although some fields are...

PT-2026-72357

In the Linux kernel, the following vulnerability has been resolved: kho: make sure scratch size is always aligned by CMA MIN ALIGNMENT BYTES When using scratch scale, the scratch sizes are rounded up to CMA MIN ALIGNMENT BYTES since they will be released as MIGRATE CMA. This is not done when usin...

PT-2026-72318

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet rdma use inline sg maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len offset = off;...

PT-2026-72613

In the Linux kernel, the following vulnerability has been resolved: ice: fix FDIR CTRL VSI resource leak in ice reset all vfs Resetting all VFs causes resource leak on VFs with FDIR filters enabled as CTRL VSIs are only invalidated and not freed. Fix by using ice vf ctrl vsi release instead of ic...

PT-2026-72650

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race in unix socket mediation when peer path is used The holding a reference to the peer sk is not enough to ensure access to the peer sk path. Accessing the path outside of the state lock allows for a race with uni...

PT-2026-72645

In the Linux kernel, the following vulnerability has been resolved: apparmor: fail policy unpack on accept2 allocation failure unpack pdb may need to allocate a missing ACCEPT2 table for older policy data. If that allocation failed, it set an error message but jumped to the success path, returnin...

PT-2026-72640

In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intel crtc put color blobs drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intel crtc prepare cleared state,...

PT-2026-72562

In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incomi...

PT-2026-72601

In the Linux kernel, the following vulnerability has been resolved: sctp: fix err chunk memory leaks in INIT handling When sctp verify init encounters unrecognized parameters, it allocates an err chunk to report them. However, this chunk is leaked in several code paths: 1. In sctp sf do 5 1B init...

PT-2026-72602

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: round up PTP perout pin duration pin duration is converted from the user-provided period to SJA1105 clock ticks and is later passed as the cycle time argument to future base time. Very small period values may...

PT-2026-72600

In the Linux kernel, the following vulnerability has been resolved: s390/mm: Fix handling of PAGE UNUSED pte bit The PAGE UNUSED softbit should not really be lying around. Its sole purpose is to signal to try to unmap one and try to migrate one that the page can be discarded instead of being move...

PT-2026-72560

In the Linux kernel, the following vulnerability has been resolved: afs: Fix lack of locking around modifications of net-cells dyn ino Fix the lack of locking around modifications of net-cells dyn ino by taking net-cells lock exclusively. This also requires to cell to be removed from net-cells dy...

PT-2026-72641

In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cache ops-populate callback, and if cache operations include an exit callback, the error code from...

PT-2026-72625

In the Linux kernel, the following vulnerability has been resolved: md/raid1: free r1 bio when REQ NOWAIT is set and read would block on retry When a read is retried, raid1 read request may be called with a pre-allocated r1 bio. If wait read barrier fails for a REQ NOWAIT read, the bio is complet...

PT-2026-72620

In the Linux kernel, the following vulnerability has been resolved: tpm crb: Check ACPI COMPANION against NULL during probe Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device match driver override, so platform drivers that rely on the...

PT-2026-72658

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log-one page buf when adopting on-disk page size log replay allocates log-one page buf using the page size that was chosen from the host PAGE SIZE: log-one page buf = kmalloclog-page size, GFP NOFS; Later, when a...