PT-2026-72930

In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector mmsg rx When vector mmsg rx discards a packet whose overlay header fails verify header, it frees the skb and continues the loop: if header check estats.rx encaps errors++; continue; The...

PT-2026-72313

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rx lock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

PT-2026-73001

In the Linux kernel, the following vulnerability has been resolved: hwmon: nct6775-core Prevent access to unsupported weight registers Sashiko reports: During initialization of the nct6116 chip, the driver sets data-pwm num to 5. However, it assigns several NCT6106 register arrays such as NCT6106...

PT-2026-72947

In the Linux kernel, the following vulnerability has been resolved: igbvf: Fix leak in TX DMA error cleanup If an error is encountered while mapping TX buffers, the driver should unmap any buffers already mapped for that skb. Because count is incremented before each frag mapping, it will always...

PT-2026-72923

In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of register event in trace module add events trace module add events ignores the return value of register event and unconditionally calls add event to tracers for each event. If register event fails fo...

PT-2026-72588

In the Linux kernel, the following vulnerability has been resolved: seg6: validate SRH length before reading fixed fields seg6 validate srh reads fixed SRH fields such as srh-type and srh-hdrlen before checking that the supplied length covers the fixed struct ipv6 sr hdr fields. The BPF SEG6 enca...

PT-2026-72605

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: Validate iph-ihl in nf flow ip4 tunnel proto Add sanity check for iph-ihl field in nf flow ip4 tunnel proto before using it to compute the header size, avoiding out-of-bounds access with malformed IP headers...

PT-2026-72353

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix condition in 'nand select target' 'cs' here must be in range 0:nanddev ntargets...

PT-2026-72558

In the Linux kernel, the following vulnerability has been resolved: iomap: release pages on atomic dio size mismatch If bio iov iter get pages or the bounce helper succeeds but builds a short bio, the REQ ATOMIC size check rejects it before submission. The old error path only dropped the bio...

PT-2026-72721

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netif rxq cleanup unlease tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA...

PT-2026-72870

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpc recvmsg oob takes a received oob message off recvmsg oobq and, if a response is needed, moves it onto the pending oobq tree. However, only the unlink from recvms...

PT-2026-72280

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdna drm submit execbuf passes the user-supplied command BO handle straight into amdxdna cmd submit with drv cmd == NULL. When the handle is AMDXDNA INVALID BO...

PT-2026-72140

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business id' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-72894

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: avoid destroy workqueueNULL on vkms init failure Two paths through vmw vkms init can leave vmw-crc workq NULL while still leaving the rest of the driver in a state that calls vmw vkms cleanup at module unload: 1. vmw...

PT-2026-72523

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hci add adv monitor publishes a new adv monitor in hdev-adv monitors idr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...

PT-2026-72764

In the Linux kernel, the following vulnerability has been resolved: iommufd: Destroy the pages content after detaching from dmabuf Sashiko points out this has gotten out of order, the mutex could still be in use through the dmabuf invalidation callbacks. Don't destroy any of the pages content unt...

PT-2026-72750

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpf obj free fields when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete...

PT-2026-72272

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core scsi3 emulate pro register and move maps the PERSISTENT RESERVE OUT parameter list with transport kmap data sg and parses the destination TransportID wit...

PT-2026-72526

In the Linux kernel, the following vulnerability has been resolved: net/sched: act pedit: fix TOCTOU heap OOB write in tc offload There is a TOCTOU race condition in flower lockless approach between sizing a flow rule buffer and filling it. [email protected] reports: The cls flower...

PT-2026-72321

In the Linux kernel, the following vulnerability has been resolved: NFS: Charge unstable writes by request size, not folio size nfs folio mark unstable and nfs folio clear commit charge and uncharge NR WRITEBACK/WB WRITEBACK by folio nr pagesfolio once per request added to or removed from a commi...

PT-2026-73044

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=site settings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...

PT-2026-73023

In the Linux kernel, the following vulnerability has been resolved: btrfs: skip global block reserve accounting for rescue mounts BUG Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference: BUG: kernel NULL pointer dereference, address:...

PT-2026-73014

In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh-lock for f6i list walks in replace check and notify fib6 check nh list and nexthop replace notify walk nh-f6i list during an RTNL-serialized nexthop replace without holding nh-lock. IPv6 RTM NEWROUTE/RTM DELROUTE...

PT-2026-72961

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: Fix advertising data UAFs hci find adv instance returns an adv info pointer that is valid only while hdev-lock is held. The advertising command-sync paths perform instance lookups without that lock and, in so...

PT-2026-72952

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix stack info leak in RME Digiface status snd rme digiface read status reads a four-word status block from the device into an uninitialised on-stack le32 buf4 and, whenever the vendor control-IN transfer does no...

PT-2026-72954

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of out cvts on rawmidi error snd ump attach legacy rawmidi allocates the legacy conversion array ump-out cvts and, on the snd rawmidi new error path, frees it with kfree but leaves ump-out cvts pointing...

PT-2026-72953

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in ump to endpoint create midi2 ump registers a card-owned snd ump endpoint and stores a back-pointer to its per-interface snd usb midi2 ump object in ump-private data, but it never installs an...

PT-2026-73066

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected is an unknown function of the file /action.php. This manipulation of the argument proId causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be...

PT-2026-73053

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Improper restriction of authentication attempts occurs in the CheckAuth middleware. The HTTP Basic Authentication branch, which protects most of the /api/ endpoints, accepts the workspace access code...

PT-2026-73048

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Insufficient validation or escaping of annotation fields written to disk via the 'setFileAnnotation' endpoint allows attackers to inject malicious markup. This markup executes as a script within the P...

PT-2026-72899

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32 t overflow in EOP ring buffer size alignment eop ring buffer size in struct queue properties is a u32. In kfd queue acquire buffers the expected EOP buffer size is computed as ALIGNeop ring buffer size, PAG...

PT-2026-72903

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes iface fw to cpu addr only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware...

PT-2026-72901

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix divide-by-zero in calculate mcache setting on zero viewport If a plane reaches calculate mcache setting with a zero-area viewport, calculate mcache setting exits early with num mcaches == 0 and mvmpg...

PT-2026-72904

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthor fw load section entry, the data size to copy is calculated without validating it against the allocated section size: section-data.size = hdr.data.end -...

PT-2026-72886

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchange mode causes missing encryption of sensitive data. It is possible to initiate the...

PT-2026-72905

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Ea...

PT-2026-72895

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmw cmd dma locates the DMA suffix at unsigned long &cmd-body + header-size - sizeofsuffix without checking that header-size is large enough to contain both cmd-body...

PT-2026-72889

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewmedicine.php. Performing a manipulation of the argument delid results in sql injection. The attack can be initiated remotely. The exploit has been released to the...

PT-2026-72935

In the Linux kernel, the following vulnerability has been resolved: binfmt misc: don't leak the user namespace when the mount fails bm get tree takes a reference to the user namespace and hands it to get tree keyed as the sget key. sget fc moves that reference into sb-s fs info and clears fc-s fs...

PT-2026-72931

In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix proc entry use-after-free pktgen change name replaces pkt dev-entry while holding t-if lock. pktgen remove device removes the same entry before rem dev from if list takes that lock. This allows the following...

PT-2026-72985

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs kref get unless zero hci conn::iso data is accessed and modified without lock or RCU. This leads to a race Task hdev-workqueue Task 2 iso recv iso conn putconn conn = LOAD hcon-iso data iso co...

PT-2026-72315

In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronize rcu in isotp release isotp notify unregisters the RCU CAN filters via can rx unregister and clears so-bound without waiting for a grace period. isotp release uses so-bound to decide wheth...

PT-2026-72548

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Don't attempt to process FAST REQ or EVENT relays Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt to handle FAST REQUEST nor EVENT messages as this would result in...

PT-2026-72539

In the Linux kernel, the following vulnerability has been resolved: gue: validate REMCSUM private option length GUE private flags can indicate that remote checksum offload metadata is present. The private flags field itself is accounted for by guehdr flags len, but guehdr priv flags len currently...

PT-2026-72492

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Fix TOCTOU in sof ipc4 bytes put In sof ipc4 bytes put, the copy size is derived from the old data-size in the buffer rather than the incoming new data's size field from ucontrol. If the new data has a...

PT-2026-72473

In the Linux kernel, the following vulnerability has been resolved: KVM: TDX: Reject concurrent change to CPUID entry count Reject KVM TDX INIT VM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data. tdx td init first reads user...

PT-2026-72449

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in snd sof update control In snd sof update control, firmware-provided cdata-num elems is checked against local cdata-data-size but never against the actual allocation size. If local...

PT-2026-72400

In the Linux kernel, the following vulnerability has been resolved: mm/memory hotplug: fix incorrect altmap passing in error path In create altmaps and memory blocks, when arch add memory succeeds with memmap on memory enabled, the vmemmap pages are allocated from params.altmap. If create memory...

PT-2026-72376

In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfs lookup inode by name ntfs lookup inode by name returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return a...

PT-2026-72362

In the Linux kernel, the following vulnerability has been resolved: fs/proc/task mmu: fix hugetlb self-deadlock in pagemap scan pte hole A PAGEMAP SCAN ioctl requesting PM SCAN WP MATCHING on a hugetlb VMA hangs the calling thread, unkillably, as soon as the scan reaches an unpopulated part of th...