PT-2026-117081

In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in kill rules kill rules removes mixed AUDIT DIR and AUDIT EXE rules when an audit tree is pruned. It drops entry-rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been...

PT-2026-116907

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL dereference in tb remove work There is a slight race between tb remove work and tb domain remove which leads to dereferencing a NULL tb-root switch pointer inside tb free unplugged xdomains: Thread A Thread ...

PT-2026-117061

In the Linux kernel, the following vulnerability has been resolved: module: fix lost error code from codetag load module If codetag load module fails, err is not set to reflect the failure and load module returns 0 after the module has been torn down. Also, if the module is a livepatch, mod-klp...

PT-2026-116900

In the Linux kernel, the following vulnerability has been resolved: smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races The invalidHandle, swapfile, oplock break cancelled, offload, and status file deleted fields are stored in the same bitfield byte in struct cifsFileInfo, bu...

PT-2026-116917

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FILS association request payload fils encrypt assoc req accepts a ReAssociation Request frame whose last element is the FILS Session element. crypt len is then zero and aes siv encrypt is called with ...

PT-2026-116644

librtmp RTMPDump through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer...

PT-2026-116838

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: keep rtnl lock for the ioctl self test An offline self test that brings the interface down and back up with netif close / netif open requires rtnl lock for both. Since the ethtool IOCTL path became rtnl-optional for...

PT-2026-116978

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec partner desc in cd321x update work cd321x update work passes a stack-allocated typec partner desc to typec register partner after initializing only usb pd, accessory and identity. typec...

PT-2026-116761

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Return PERR NOCPUS in remote partition enable on subpartitions cpus conflict When a remote partition is created underneath an existing local partition via a non-partition PRS MEMBER intermediate cgroup, update...

PT-2026-116711

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix dma alloc coherent leak on macb alloc error paths Fix 3 leaks in macb alloc error paths: - Tx buffer allocated but crossing a 4G boundary: Tx leaked. - Rx buffer allocation fails: Tx leaked. - Rx buffer allocated b...

PT-2026-116720

In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix use-after-free on input2 registration failure alps input configured stores data-input2 before calling input register device. If registration fails, input free device frees the input device but data-input2 still...

PT-2026-117597

These are all security issues fixed in the ab-av1-0.11.7-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-117600

These are all security issues fixed in the ansible-core-2.19-2.19.14-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-116897

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4030: fix invalid oversampling ratio validation In ad4030 set avg frame len, the logarithm is calculated before input validation. Passing zero or negative values leads to an undefined result from ilog2. Validate that...

PT-2026-116719

In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use cancel delayed work sync in remove oxp hid remove uses cancel delayed work for all three delayed work items. cancel delayed work only dequeues a pending work item without waiting for a currently executing callba...

PT-2026-116871

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Add missing srcu in kvm s390 set irq state Like kvm s390 inject vcpu, kvm s390 set irq state also needs the kvm-srcu or the slots lock when performing the Store status operation. Fix by taking kvm-srcu in kvm s390 set...

PT-2026-116699

In the Linux kernel, the following vulnerability has been resolved: nfc: trf7970a: power down on startup RX gain failure trf7970a startup powers up the device before applying the optional RX gain reduction. If the register read or write fails, it returns without undoing that power-up. Probe's...

PT-2026-116715

In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdt work after releasing the WDT IRQ airoha npu remove calls cancel work sync on each core's wdt work, but the watchdog IRQ that queues it is requested with devm request irq and is freed only after .remov...

PT-2026-117017

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix NULL dereference in set coalesce before first open The Rx ring priv and index are only set in bcmgenet init rx ring, which runs at open. Setting the Rx coalescing parameters on an interface that was never opene...

PT-2026-117020

In the Linux kernel, the following vulnerability has been resolved: net: restrict SO RESERVE MEM to TCP sockets and cap max value Commit 2bb2f5fb21b0 "net: add new socket option SO RESERVE MEM" and commit d00c8ee31729 "net: fix possible NULL deref in sock reserve memory" only checked sk has...

PT-2026-116546

The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tag...

PT-2026-116664

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repairs LOLLM complains that a memory allocation failure in xrep newbt add blocks results in online repair leaking blocks that were previously allocated to write a new btree, bu...

PT-2026-116865

In the Linux kernel, the following vulnerability has been resolved: tcp: Skip cond resched in inet csk listen stop under BPF context bpf sock destroy runs from the tcp iterator, under rcu read lock. If the sock is a listener that still has children in its accept queue, tcp abort ends up in inet c...

PT-2026-116913

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation stripped down keeping the relevant parts...

PT-2026-116956

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: Fix inquiry cache use-after-free The sync command worker holds hdev-req lock, but inquiry-cache updates and flushes use hdev-lock. Both hci acl create conn sync and hci stop discovery sync look up entries and...

PT-2026-116985

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed-vhub: cancel wake work on device removal wake work is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is never cancelled in ast vhub remove, so a work item queued before or...

PT-2026-116742

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drm atomic.c:2031 at drm atomic helper set config+0x18e/0x1b0 drm Call Trace: drm...

PT-2026-116754

In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in read dts node of clk get returns a clock with its reference count incremented, but read dts node only uses it to read the rate and never calls clk put. The clock is not stored anywhere, so the...

PT-2026-116906

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties responses tb xdp properties request allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can...

PT-2026-116921

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject invalid 320 MHz CSA bandwidth The HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a received CSA frame on a non-6 GHz link. It warns for this unsupported width but...

PT-2026-116925

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, and can update num sta ps and the...

PT-2026-116951

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: fix buffer over-read in btintel hw error The "Exception info %s" print uses skb-data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated and can be read past its end. Bound the print with "%.s"...

PT-2026-116983

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f fs: Fix NULL pointer dereference in FUNCTIONFS ENDPOINT DESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFS HAS FS DESC and the gadget operates at a higher speed such a...

PT-2026-116986

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: fix IRQ storm on invalid event buffer count When dwc3 check event buf reads a GEVNTCOUNT value exceeding the event buffer length, commit 63ccd26cd1f6 "usb: dwc3: gadget: check that event count does not exceed...

PT-2026-116654

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Use parent device for devres in altr portb setup Anchor the devres group and the devm-managed IRQ requests in altr portb setup to the actual parent device device-edac-dev instead of the embedded struct device inside...

PT-2026-116677

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hci bind cis and hci connect cis return one hci conn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by iso conn fre...

PT-2026-116727

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtio gpu fence alloc can fail due to memory pressure and return NULL, but its caller like virtio gpu init submit never checks it. Later, virtio gpu init submi...

PT-2026-117059

In the Linux kernel, the following vulnerability has been resolved: vc screen: reload vc pointer before if ret in vcs write to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 "vc screen: reload load of struct vc data pointer in vcs write to avoid UAF" sits after the 'if ret' block, so t...

PT-2026-117071

In the Linux kernel, the following vulnerability has been resolved: net: extend IPv6 exthdr detection of tunneled packets Commit c4336a07eb6b "net: correctly handle tunneled traffic on IPV6 CSUM GSO fallback" split skb gso has extension hdr into mutually exclusive branches on skb-encapsulation...

PT-2026-116971

In the Linux kernel, the following vulnerability has been resolved: tty: port: fix tty port tty vhangup race Drivers rely on tty port tty vhangup to synchronously hang up their ports before tearing down resources as part of deregistration e.g. on physical disconnect. If tty port tty vhangup races...

PT-2026-116992

In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in port shutdown if disconnected acm port shutdown is called from the tty-port machinery whenever the last user closes the port. acm disconnect sets acm-disconnected and calls tty port tty vhangup,...

PT-2026-117011

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NF FLOW HW PENDING to NF FLOW PENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nf flow offload stats ca...

PT-2026-116877

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validate firmware data length The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond...

PT-2026-117049

In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfx hif read mib copies reply-length bytes from the firmware response into the caller-provided buffer without checking that reply-length does not exceed val len. A...

PT-2026-116873

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Atomize IRQ register read/modify/write ops Why The OTG GLOBAL SYNC STATUS register controls various HW IRQ sources for the output timing generator OTG. VUPDATE NO LOCK is one of them. To enable the IRQ, driver se...

PT-2026-116552

The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types...

PT-2026-116554

The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyon...

PT-2026-117010

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AF XDP TX timestamp teardown NULL dereference During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to mlx5e xs...

PT-2026-116777

In the Linux kernel, the following vulnerability has been resolved: net: flush skb defer nodes in dev cpu dead When a CPU goes offline, dev cpu dead drains its softnet queues completion queue, output queue, poll list, process queue, and input pkt queue, but leaves net hotdata.skb defer nodes...

PT-2026-116666

In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots LOLLM noticed that the inode btree root formatting methods copy too many bytes -- there's only one set of keys in node blocks, not two. This causes memory...