PT-2026-72930

In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector mmsg rx When vector mmsg rx discards a packet whose overlay header fails verify header, it frees the skb and continues the loop: if header check estats.rx encaps errors++; continue; The...

PT-2026-72313

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rx lock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

PT-2026-73001

In the Linux kernel, the following vulnerability has been resolved: hwmon: nct6775-core Prevent access to unsupported weight registers Sashiko reports: During initialization of the nct6116 chip, the driver sets data-pwm num to 5. However, it assigns several NCT6106 register arrays such as NCT6106...

PT-2026-72947

In the Linux kernel, the following vulnerability has been resolved: igbvf: Fix leak in TX DMA error cleanup If an error is encountered while mapping TX buffers, the driver should unmap any buffers already mapped for that skb. Because count is incremented before each frag mapping, it will always...

PT-2026-72923

In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of register event in trace module add events trace module add events ignores the return value of register event and unconditionally calls add event to tracers for each event. If register event fails fo...

PT-2026-72588

In the Linux kernel, the following vulnerability has been resolved: seg6: validate SRH length before reading fixed fields seg6 validate srh reads fixed SRH fields such as srh-type and srh-hdrlen before checking that the supplied length covers the fixed struct ipv6 sr hdr fields. The BPF SEG6 enca...

PT-2026-72321

In the Linux kernel, the following vulnerability has been resolved: NFS: Charge unstable writes by request size, not folio size nfs folio mark unstable and nfs folio clear commit charge and uncharge NR WRITEBACK/WB WRITEBACK by folio nr pagesfolio once per request added to or removed from a commi...

PT-2026-73044

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=site settings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...

PT-2026-73023

In the Linux kernel, the following vulnerability has been resolved: btrfs: skip global block reserve accounting for rescue mounts BUG Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference: BUG: kernel NULL pointer dereference, address:...

PT-2026-73014

In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh-lock for f6i list walks in replace check and notify fib6 check nh list and nexthop replace notify walk nh-f6i list during an RTNL-serialized nexthop replace without holding nh-lock. IPv6 RTM NEWROUTE/RTM DELROUTE...

PT-2026-72961

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: Fix advertising data UAFs hci find adv instance returns an adv info pointer that is valid only while hdev-lock is held. The advertising command-sync paths perform instance lookups without that lock and, in so...

PT-2026-72952

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix stack info leak in RME Digiface status snd rme digiface read status reads a four-word status block from the device into an uninitialised on-stack le32 buf4 and, whenever the vendor control-IN transfer does no...

PT-2026-72954

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of out cvts on rawmidi error snd ump attach legacy rawmidi allocates the legacy conversion array ump-out cvts and, on the snd rawmidi new error path, frees it with kfree but leaves ump-out cvts pointing...

PT-2026-72953

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in ump to endpoint create midi2 ump registers a card-owned snd ump endpoint and stores a back-pointer to its per-interface snd usb midi2 ump object in ump-private data, but it never installs an...

PT-2026-73066

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected is an unknown function of the file /action.php. This manipulation of the argument proId causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be...

PT-2026-73053

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Improper restriction of authentication attempts occurs in the CheckAuth middleware. The HTTP Basic Authentication branch, which protects most of the /api/ endpoints, accepts the workspace access code...

PT-2026-73048

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Insufficient validation or escaping of annotation fields written to disk via the 'setFileAnnotation' endpoint allows attackers to inject malicious markup. This markup executes as a script within the P...

PT-2026-72899

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32 t overflow in EOP ring buffer size alignment eop ring buffer size in struct queue properties is a u32. In kfd queue acquire buffers the expected EOP buffer size is computed as ALIGNeop ring buffer size, PAG...

PT-2026-72903

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes iface fw to cpu addr only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware...

PT-2026-72901

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix divide-by-zero in calculate mcache setting on zero viewport If a plane reaches calculate mcache setting with a zero-area viewport, calculate mcache setting exits early with num mcaches == 0 and mvmpg...

PT-2026-72904

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthor fw load section entry, the data size to copy is calculated without validating it against the allocated section size: section-data.size = hdr.data.end -...

PT-2026-72886

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchange mode causes missing encryption of sensitive data. It is possible to initiate the...

PT-2026-72905

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Ea...

PT-2026-72895

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmw cmd dma locates the DMA suffix at unsigned long &cmd-body + header-size - sizeofsuffix without checking that header-size is large enough to contain both cmd-body...

PT-2026-72889

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewmedicine.php. Performing a manipulation of the argument delid results in sql injection. The attack can be initiated remotely. The exploit has been released to the...

PT-2026-72935

In the Linux kernel, the following vulnerability has been resolved: binfmt misc: don't leak the user namespace when the mount fails bm get tree takes a reference to the user namespace and hands it to get tree keyed as the sget key. sget fc moves that reference into sb-s fs info and clears fc-s fs...

PT-2026-72931

In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix proc entry use-after-free pktgen change name replaces pkt dev-entry while holding t-if lock. pktgen remove device removes the same entry before rem dev from if list takes that lock. This allows the following...

PT-2026-72985

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs kref get unless zero hci conn::iso data is accessed and modified without lock or RCU. This leads to a race Task hdev-workqueue Task 2 iso recv iso conn putconn conn = LOAD hcon-iso data iso co...

PT-2026-72315

In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronize rcu in isotp release isotp notify unregisters the RCU CAN filters via can rx unregister and clears so-bound without waiting for a grace period. isotp release uses so-bound to decide wheth...

PT-2026-72548

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Don't attempt to process FAST REQ or EVENT relays Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt to handle FAST REQUEST nor EVENT messages as this would result in...

PT-2026-72539

In the Linux kernel, the following vulnerability has been resolved: gue: validate REMCSUM private option length GUE private flags can indicate that remote checksum offload metadata is present. The private flags field itself is accounted for by guehdr flags len, but guehdr priv flags len currently...

PT-2026-72492

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Fix TOCTOU in sof ipc4 bytes put In sof ipc4 bytes put, the copy size is derived from the old data-size in the buffer rather than the incoming new data's size field from ucontrol. If the new data has a...

PT-2026-72473

In the Linux kernel, the following vulnerability has been resolved: KVM: TDX: Reject concurrent change to CPUID entry count Reject KVM TDX INIT VM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data. tdx td init first reads user...

PT-2026-72449

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in snd sof update control In snd sof update control, firmware-provided cdata-num elems is checked against local cdata-data-size but never against the actual allocation size. If local...

PT-2026-72400

In the Linux kernel, the following vulnerability has been resolved: mm/memory hotplug: fix incorrect altmap passing in error path In create altmaps and memory blocks, when arch add memory succeeds with memmap on memory enabled, the vmemmap pages are allocated from params.altmap. If create memory...

PT-2026-72376

In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfs lookup inode by name ntfs lookup inode by name returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return a...

PT-2026-72362

In the Linux kernel, the following vulnerability has been resolved: fs/proc/task mmu: fix hugetlb self-deadlock in pagemap scan pte hole A PAGEMAP SCAN ioctl requesting PM SCAN WP MATCHING on a hugetlb VMA hangs the calling thread, unkillably, as soon as the scan reaches an unpopulated part of th...

PT-2026-72359

In the Linux kernel, the following vulnerability has been resolved: mtd: slram: remove failed entries from the device list register device links a new slram mtdlist entry before allocating all of the state needed by the entry. If a later allocation, memremap, or mtd device register fails, the...

PT-2026-72355

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: pl353: fix probe resource allocation During probe, the devm ioremap is called with the parent device instead of the current one. So when the module is unloaded, the register area isn't released. Target the pl35x...

PT-2026-72341

In the Linux kernel, the following vulnerability has been resolved: irqchip/crossbar: Use correct index in crossbar domain free crossbar domain free resets the domain data and then uses the nulled out irq data-hwirq member as index to reset the irq map entry and to write the relevant crossbar...

PT-2026-72621

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft meta bridge: fix NFT META BRI IIFPVID stack leak This needs to test for nonzero retval...

PT-2026-72648

In the Linux kernel, the following vulnerability has been resolved: apparmor: check label build before no new privs test aa change profile builds a replacement label with fn label build in scope before the no new privs subset check. The build helper can fail and return NULL or an ERR PTR, but the...

PT-2026-72629

In the Linux kernel, the following vulnerability has been resolved: ieee802154: fix kernel-infoleak in dgram recvmsg KMSAN reported a kernel-infoleak in move addr to user: BUG: KMSAN: kernel-infoleak in instrument copy to user include/linux/instrumented.h:131 inline BUG: KMSAN: kernel-infoleak in...

PT-2026-72634

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: reject stream disable with no active interface handle uaudio stream req resolves an interface index with info idx from ifnum, which returns -EINVAL when no interface matches. The enable branch and the...

PT-2026-72587

In the Linux kernel, the following vulnerability has been resolved: net: enetc: check the number of BDs needed for xdp frame The size of xdp redirect arr array is ENETC MAX SKB FRAGS. However, the number of fragments contained in xdp frame may be greater than or equal to ENETC MAX SKB FRAGS, whic...

PT-2026-72595

In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in geneve gro complete Even with both paths gated on gs-gro hint, geneve gro complete re-derives the inner dispatch type and length from the packet and the current gs-gro hint, independently ...

PT-2026-72596

In the Linux kernel, the following vulnerability has been resolved: geneve: gate GRO hint in geneve gro complete on gs-gro hint geneve gro receive reads the GRO hint through geneve sk gro hint off, which honours it only when the socket enabled IFLA GENEVE GRO HINT gs-gro hint. geneve gro complete...

PT-2026-72584

In the Linux kernel, the following vulnerability has been resolved: hwmon: adm1275: Prevent reading uninitialized stack While adding support for the ROHM BD127X0 hot-swap controllers, sashiko reported an error in device-name comparison, which can lead to reading uninitialized stack memory. Quotin...

PT-2026-72591

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcp find fc interface currently selects the first vendor-specific...

PT-2026-72666

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add bounds check to run get highest vcn run get highest vcn parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile UpdateMappingPairs record...