PT-2026-72997

In the Linux kernel, the following vulnerability has been resolved: rtase: fix double free of multi-frag skb on DMA map failure In rtase start xmit, when the head buffer DMA mapping fails after rtase xmit frags has mapped all fragments, the error path clears the fragment descriptors with rtase tx...

PT-2026-72344

In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero header size OOB read in mpf ops parse header mpf ops parse header reads header size from the bitstream at MPF HEADER SIZE OFFSET 24. When header size is zero, the expression buf + header size - 1 rea...

PT-2026-72349

In the Linux kernel, the following vulnerability has been resolved: ocfs2: add journal NULL check in ocfs2 checkpoint inode During unmount, ocfs2 journal shutdown frees the journal and sets osb-journal to NULL. Later, when VFS evicts remaining cached inodes, ocfs2 evict inode - ocfs2 clear inode ...

PT-2026-72277

In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path If phys disk-in reset is set, the function returns directly without undoing the resources acquired for the command. Add the missing error cleanup by unmapping the IOACCEL2 S...

PT-2026-72293

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject option groups without values The pcache target parses optional arguments as name/value pairs. A table that advertises one optional argument and supplies only a recognized option name, for example "cache mode",...

PT-2026-72211

In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llc ui autobind llc ui autobind opens a SAP after choosing a dynamic LSAP. llc sap open returns a reference owned by the caller, and llc sap add socket takes a second reference for the socket's...

PT-2026-72210

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup set sctp state reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

PT-2026-72195

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: free mlx5 st idx data on final dealloc Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints e.g. churning RDMA MRs leak one struct mlx5 st idx data per cycle; kmemleak flags it as...

PT-2026-72186

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufs mem mmap access spufs mem mmap access computes the local store offset as address - vma-vm start, but bounds-checks it against vma-vm end instead of the local store size. On 64-bit,...

PT-2026-72194

In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00lib probe dev uses the full rt2x00lib remove dev teardown for all probe failures. However, drv data allocation and workqueue allocation can fail before intf work,...

PT-2026-72327

In the Linux kernel, the following vulnerability has been resolved: tcp: defer md5sig info kfree past RCU grace period in tcp connect The md5+ao reconciliation in tcp connect net/ipv4/tcp output.c has two symmetric branches: if needs md5 tcp ao destroy socksk, false; else if needs ao tcp clear md...

PT-2026-72538

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt u32: reject invalid shift counts u32 match it executes rule-supplied shift operands on a 32-bit value. A malformed u32 rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during...

PT-2026-72633

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: clear opened when stream enable fails On enable, subs-opened is set before the service interval is validated; an invalid interval jumps to the response label without clearing it, so the substream is wedged ...

PT-2026-72537

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt rateest: fix u64 truncation in xt rateest mt On links faster than 34 Gbps, where byte rate may exceed 2^32-1 4.3 GBps, the comparison result becomes incorrect because the truncated value no longer reflects the actua...

PT-2026-72693

In the Linux kernel, the following vulnerability has been resolved: sockmap: Fix use-after-free in udp bpf recvmsg syzbot reported use-after-free of struct sk msg in sk msg recvmsg. 0 sk msg recvmsg peeks sk msg from psock-ingress msg under a lock, but its processing is lockless. Thus, sk msg...

PT-2026-72838

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix blocking and non-blocking rng logic The blocking and non-blocking paths were failing to provide valid entropy due to improper buffer management. Reading the buffer starting from byte 1, only fetch the ...

PT-2026-72412

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Free arenas on btt init error paths The arenas allocated by discover arenas or create arenas are not freed on some error paths in btt init. This leaks memory when BTT initialization fails. Call free arenas from the...

PT-2026-72948

In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in fou create fou create publishes struct fou through sk user data before adding the new FOU port to the per-netns list. If fou add to port list fails, the error path frees fou while it is still reachable...

PT-2026-72391

In the Linux kernel, the following vulnerability has been resolved: ntfs: skip extent mft records in writeback to prevent deadlock This patch fixes the ABBA deadlock between extent lock and extent mrec lock triggered by xfstests generic/113, that occurs since the commit 6994acf33bae "ntfs: use ba...

PT-2026-72219

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid concurrent positioning ranges count ata dev config cpr takes the number of range descriptors from buf0 of the concurrent positioning ranges log up to 255, which the device reports independently...

PT-2026-73032

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the...

PT-2026-72487

In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tracepoints tipc sk enqueue runs with sk-sk lock.slock held while the socket is owned by user context. The spinlock protects the backlog queue in this path, but it does not serialize...

PT-2026-72506

In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets parse dfs referrals validates that the response header and referral array fit in the received buffer, but each referral also contains string offsets supplied by the server. Those offsets...

PT-2026-72507

In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskb pull we should ensure the inner IP headers in ICMP errors from tunnels are present in the skb headroom...

PT-2026-72624

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use test bit in lockless RCU readers in hash types Sashiko pointed out that there are a few lockless RCU readers using test bit which is a relaxed atomic operation and provides no memory barrier guarantees...

PT-2026-72332

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-laptop: fix missing cleanups in init error path dell init initializes several resources after dell setup rfkill, including the optional touchpad LED, keyboard backlight LED, battery hook, debugfs directory and...

PT-2026-72140

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business id' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-72608

In the Linux kernel, the following vulnerability has been resolved: md/raid5: avoid R5 Overlap races while breaking stripe batches KCSAN report a race in break stripe batch list vs. raid5 make request on sh-devi.flags plain word write vs. atomic bit op.. and .. one possible scenario is: CPU1 CPU2...

PT-2026-72683

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt re: Avoid repeated requests to allocate WC pages Applications can request multiple WC pages for the same ucontext. As of now, only 1 WC page per ucontext is supported. Add a lock to avoid concurrent access and a check t...

PT-2026-72573

In the Linux kernel, the following vulnerability has been resolved: tracing/fprobe: Fix NULL pointer dereference in fprobe fgraph entry fprobe fgraph entry sizes a shadow-stack reservation in one walk of the per-ip fprobe list and fills it in a second walk, both under rcu read lock only. A fprobe...

PT-2026-73019

In the Linux kernel, the following vulnerability has been resolved: keys: fix out-of-bounds read in keyring get key chunk For description-level chunks keyring get key chunk advances the read pointer by level sizeoflong past the inline prefix but only bounds-checks the prefix, so a long enough key...

PT-2026-72703

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch codel: Do not call qdisc tree reduce backlog during peek before restoring qlen Whenever codel drops packets during peek, it calls qdisc tree reduce backlog. An issue arises because it calls qdisc tree reduce backlo...

PT-2026-72579

In the Linux kernel, the following vulnerability has been resolved: net: phy: sfp: free mii bus in sfp i2c mdiobus destroy sfp i2c mdiobus create allocates the I2C MDIO bus with mdio i2c alloc, a plain non-devm allocation, and registers it. sfp i2c mdiobus destroy only unregisters the bus and...

PT-2026-72635

In the Linux kernel, the following vulnerability has been resolved: sctp: hold socket lock when dumping endpoints in sctp diag SCTP DIAG endpoint dumping was traversing endpoint address lists without holding lock sock, while those lists could change concurrently via socket operations e.g., bindx...

PT-2026-72570

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parse dacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

PT-2026-72965

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmb node in loopback attach/detach/unregister dibs lo attach dmb, dibs lo detach dmb and dibs lo unregister dmb look up the dmb node under dmb ht lock, drop the lock and only then operate on the node's...

PT-2026-72939

In the Linux kernel, the following vulnerability has been resolved: binfmt misc: restore write access when removing an entry Registering an entry with the MISC FMT OPEN FILE flag opens the interpreter via open exec which denies write access to it for as long as the entry exists. Removing the entr...

PT-2026-72409

In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When wait for completion interruptible timeout in svc tcp handshake returns 0 timeout or -ERESTARTSYS signal and tls handshake cancel then returns false,...

PT-2026-72497

In the Linux kernel, the following vulnerability has been resolved: tracing/remotes: Fix leak in trace remote alloc buffer error path If page allocation fails in trace remote alloc buffer, desc-nr cpus is not yet incremented for the current CPU. As a consequence, on error, half-allocated rb desc...

PT-2026-76448

These are all security issues fixed in the obs-service-cargo-7.2.2-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-76451

These are all security issues fixed in the rustup-1.29.00-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-72917

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix potential UAF on meter attach failure While attaching a newly created meter attach meter function makes the new meter visible to other CPUs but can still fail afterwards. On failure, it detaches the meter ba...

PT-2026-72304

In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op ifindex == 0 with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces:...

PT-2026-72930

In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector mmsg rx When vector mmsg rx discards a packet whose overlay header fails verify header, it frees the skb and continues the loop: if header check estats.rx encaps errors++; continue; The...

PT-2026-72313

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rx lock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

PT-2026-73001

In the Linux kernel, the following vulnerability has been resolved: hwmon: nct6775-core Prevent access to unsupported weight registers Sashiko reports: During initialization of the nct6116 chip, the driver sets data-pwm num to 5. However, it assigns several NCT6106 register arrays such as NCT6106...

PT-2026-72947

In the Linux kernel, the following vulnerability has been resolved: igbvf: Fix leak in TX DMA error cleanup If an error is encountered while mapping TX buffers, the driver should unmap any buffers already mapped for that skb. Because count is incremented before each frag mapping, it will always...

PT-2026-72923

In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of register event in trace module add events trace module add events ignores the return value of register event and unconditionally calls add event to tracers for each event. If register event fails fo...

PT-2026-73018

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring key-chunk byte order agree with keyring diff objects keyring get key chunk loads description bytes into the index chunk low address first, while keyring diff objects numbers the first differing bit from the low...

PT-2026-72580

In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6: fix NULL deref in fib6 walk continue on multi-batch dump inet6 dump fib saves its progress in cb-args1 as a positional index within the current hash chain. Between batches, a concurrent fib6 new table can insert a new...