PT-2026-117039

In the Linux kernel, the following vulnerability has been resolved: blk-mq: set RQF USE SCHED when the operation is known The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQF USE SCHED cleared, so using those flags for a subsequent...

PT-2026-116879

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup The sampling frequency tables store each frequency as an integer part and a fractional part in micro units. num sampling freq avail is initialized to th...

PT-2026-116904

In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via clone range cifs remap file range discarded the pagecache only for the folios overlapping the destination region, so when a clone extends the file the folio...

PT-2026-117031

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctp dev only after it is initialised mctp add dev links the new mctp dev into dev-mctp ptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a net device pointer...

PT-2026-116630

OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident A...

PT-2026-116937

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM before clearing SEV state Explicitly flush caches after intra-host migration before clearing "SEV active" on the source VM, as doing cache maintenance afterwards creates a tiny wind...

PT-2026-117045

In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Fix clock provider use-after-free on probe failure ac100 rtc register clks registers the RTC-32k clock with clk hw register fixed rate and the clock provider with of clk add hw provider. Neither is device managed, and...

PT-2026-117033

In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been...

PT-2026-116538

A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Executing a manipulation of the argument query/qtype/sortname/sortorder c...

PT-2026-116781

In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix races in Tx timestamp handling wx-ptp tx skb is shared between the Tx path, the PTP auxiliary worker and the timestamp cleanup paths. The WX STATE PTP TX IN PROGRESS bit prevents multiple Tx paths from submitting...

PT-2026-116999

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpu discovery sysfs ips allocates ip hw instance with kzalloc flex and initializes its embedded kobject before calling kobject add. If kobject add fails, the retur...

PT-2026-116721

In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alps input configured allocates a second input device "DualPoint Stick" with input allocate device and registers it, but the alps driver struct has no .remove handler a...

PT-2026-116975

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3 pci probe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pci set drvdata, while the second...

PT-2026-116621

JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like...

PT-2026-116899

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Prevent memory leak and fix state The driver allocates memory for samples at buffer enable path. If regmap operation fails in the kx022a fifo enable at the buffer enable path, the allocated memory is...

PT-2026-117054

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Fix array boundary check The driver performs a sanity check for an array size, when converting a register value to an array index. The check incorrectly accepts the sizeofarray as a last index, when las...

PT-2026-117067

In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Assign .num before accessing .hws Commit f316cdff8d67 "clk: Annotate struct clk hw onecell data with counted by" annotated the hws member of 'struct clk hw onecell data' with counted by, which informs the bounds...

PT-2026-116694

In the Linux kernel, the following vulnerability has been resolved: s390/cmf: Fix virtual vs physical address confusion The measurement block address is an absolute address. Define the associated schib config and schib fields as dma64 t to enable automatic detection of incorrect assignments. Also...

PT-2026-116686

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 "KVM: arm64: nv: Handle VNCR EL2 invalidation from MMU notifiers" introduced VNCR EL2 invalidation in both kvm nested s2 unmap and kvm neste...

PT-2026-117038

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8 MAX, and records exceeding...

PT-2026-116876

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix iio device left registered on PM setup failure pm runtime set active failing in probe jumps to error unreg buffer, which only calls iio triggered buffer cleanup -- it does not undo the iio device...

PT-2026-117032

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpf ma set dtor duplicates map-record so that the bpf mem alloc destructor can release the special fields of hash and rhash map elements once the allocator frees them f...

PT-2026-116834

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Set AW FLUSH MODE alongside AW FLUSH when flushing the mailbox When tearing down the FW mailbox Rx ring, fbnic mbx reset desc ring writes AW CFG with FLUSH set and everything else, BME included, cleared. Clearing BME...

PT-2026-116507

Name of the Vulnerable Software and Affected Versions ip-address versions prior to 10.7.4 Description A denial of service occurs due to quadratic complexity in CPU consumption and application stall. This happens when a large number of % characters in the input reach a function call that utilizes...

PT-2026-116936

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

PT-2026-117025

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix aura BPID assignment when CONFIG DCB is enabled Previously, BPID assignment under CONFIG DCB assumed queue to pfc map was always initialized. For SDP VFs this leads to invalid memory access as it was not...

PT-2026-116631

Name of the Vulnerable Software and Affected Versions libspatialite versions prior to 5.1.1 Description The software fails to validate the polygon ring count within the ParseWkbPolygon function. This allows an attacker to trigger uncontrolled interior-ring allocation by providing crafted geometry...

PT-2026-116635

Name of the Vulnerable Software and Affected Versions libspatialite versions prior to 5.1.1 Description An integer overflow exists in the WKB point and vertex count size guard within the ParseWkbLine function and related parsers in gg wkb.c. This flaw allows out-of-bounds reads when processing a...

PT-2026-116889

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind The ZYNQ XADC alarm IRQ handler queues zynq unmask work via schedule delayed work; that work is cleared by a devm callback. Register the devm callback...

PT-2026-116763

In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnad pci remove and the probe disable ioceth path call timer delete sync for ioc timer, sem timer and hb timer, but not for iocpf timer. bn...

PT-2026-116856

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure pkvm vcpu init sve clears KVM ARM VCPU SVE in kvm-arch.vcpu features when it fails, but vcpu has sve tests KVM ARCH FLAG GUEST HAS SVE, which is left set. Later...

PT-2026-116909

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix domain reference leak when DPRX read is canceled tb tunnel one dp takes a domain reference which is only dropped once tb dp tunnel active has run on the work queue. If that work is cancelled that reference is...

PT-2026-116934

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Preserve TLB control i.e. pending TLB flush on failed VMRUN Don't reset the VMCB's TLB control back to "do nothing" on a failed VMRUN, as empirical testing shows that the CPU performs the requested TLB flush if and only...

PT-2026-116959

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Drop init from ECC setup paths for re-probe safety Sashiko reports: "Does suppressing sysfs unbinding fully prevent the execution of freed init memory? If altr sysmgr regmap lookup by phandle returns -EPROBE DEFER, t...

PT-2026-116691

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Free have run cpus during VM destruction even if VM is no longer SEV Unconditionally free SEV's "have run CPUs" cpumask in the VM destroy path, i.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV...

PT-2026-116818

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stack slot obj get spi bpf get spi computes -off - 1 / BPF REG SIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot...

PT-2026-116943

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nr descs zero, so nvmet pci epf get sgl segment reads the type byte of sgls-1 outside...

PT-2026-116748

In the Linux kernel, the following vulnerability has been resolved: gpio: arizona: Fix runtime PM leak in arizona gpio direction out Switching a persistent GPIO line from input to output acquires a runtime PM reference on the parent device, but if the subsequent regmap update bits fails the...

PT-2026-116671

In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens open cached dir sends CREATE and QUERY INFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common...

PT-2026-116746

In the Linux kernel, the following vulnerability has been resolved: gpio: zynq: fix runtime PM leak on request error path pm runtime get sync leaves the usage counter incremented even when it fails, and zynq gpio request returns the error without dropping it. gpiolib does not call -free when...

PT-2026-116887

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iio push to buffers with ts unaligned leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is...

PT-2026-116898

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxcjk-1013: reject duplicate event disable The IIO core does not filter duplicate writes to the event enable attribute. kxcjk1013 write event config already ignores repeated enable requests, but a repeated disable...

PT-2026-116918

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF mesh fast tx cache stores raw mesh path pointers. Path deletion flushes the cache and then frees the path with kfree rcu, but a lookup that already holds the path can insert a...

PT-2026-116958

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMM RELEASE ONHUP devices, rfcomm tty install and rfcomm release dev both use RFCOMM TTY OWNED to decide who drops the initial tty port reference. The release path tests t...

PT-2026-116964

In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems When system supports sme is true but system supports sve is false, restoring a specifically crafted SVE signal context can result in the task erroneously...

PT-2026-116744

In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag list in mctp lookup prealloc tag When a socket transmits a packet with MCTP TAG PREALLOC set, mctp lookup prealloc tag iterates over the per-netns &mns-keys list and matches netid, req tag, peer...

PT-2026-116861

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc bulk Syzkaller repeatedly triggered UAF splats related to nodes in waiting for gp ttrace within the bpf memalloc: BUG: KASAN: slab-use-after-free in llist del...

PT-2026-116965

In the Linux kernel, the following vulnerability has been resolved: serial: ma35d1: Fix clock reference leak in ma35d1serial probe of clk get returns a clock with a reference that has to be released with clk put. ma35d1serial probe never does that, so the reference is leaked on the probe error...

PT-2026-116837

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx and Rx queue. fbnic's allocation path excludes FBNIC MAX TXQS from that layout. A 64-Tx/64-Rx configuration therefore records 128...

PT-2026-116875

In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenable work before freeing trigger iio trigger notify done atomic defers -reenable into trig-reenable work on the system workqueue, and the worker dereferences the owning trigger through container of. Nothi...