PT-2026-117070

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft flow offload: drop flowtable reference on init error path nft flow offload init bumps the flowtable use count with nft use inc before calling nf ct netns get. When the latter fails, the error is returned as-is and...

PT-2026-116785

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist reconstruction requests The firmware reconstruction count controls accesses to the request's fixed freelist ID array and the copy into the fixed response array. Neither access currently bounds the...

PT-2026-116768

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcp write collapse fence sets TCP SKB CBskb-eor = 1 on tcp write queue tailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier...

PT-2026-116801

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfca hci i2c repack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...

PT-2026-116808

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject pkt arguments in mutating subprogs The verifier tracks changes in how PTR TO PACKET registers' bounds are modified across subprog boundaries. PTR TO PACKET registers are actually passed as PTR TO MEM, which is assumed...

PT-2026-116809

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf sock context code generation Currently, the ctx access code reads the rx queue mapping field with either a 4-byte or 2-byte load. The rest of the bits in the register are marked known zero by the verifier. However, t...

PT-2026-116736

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveau uvmm sm when BO is in TTM PL SYSTEM nouveau uvmm sm calls op map, which passes bo-resource through nouveau mem to nouveau uvma map. nouveau uvmm vmm map then reads mem-mem.type. But this is on...

PT-2026-116807

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject max entries INT MAX in sock map alloc sock map alloc only rejects max entries == 0 and otherwise allows any u32 value. sock map free then walks the sks array with a signed int iterator: int i; for i = 0; i...

PT-2026-116735

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1a ram new pci get domain bus and slot takes a reference to the PCI device, which is never released once the memory size has been read from its config space. Drop the reference before...

PT-2026-116723

In the Linux kernel, the following vulnerability has been resolved: PCI: of property: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

PT-2026-116827

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak in virtio gpu resource create ioctl virtio gpu resource create ioctl calls drm gem object release on the drm gem handle create error path instead of dropping the reference it owns, so obj-funcs-free...

PT-2026-116825

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: release the GEM object on virtio gpu vram create errors virtio gpu vram create frees the object with a bare kfreevram on both error paths after drm gem private object init has run, and on the second one after drm gem...

PT-2026-116707

In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on out-of-range hw next to clean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpd cons read": the hardware can report an out-of-range hw ne...

PT-2026-116829

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch hfsc: bound the classify inner-filter walk with a drift budget hfsc classify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a...

PT-2026-116739

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix use-after-free and multi-container gap in kfd dev mapping kfd dev mapping caches the address space of the first /dev/kfd opener so that the GPU reset path can call unmap mapping range to zap all userspace mappings...

PT-2026-116795

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfc llcp wks sap and nfc llcp build sdreq tlv pass non-null- terminated strings to pr debug using the %s format specifier. The buffers are allocated via kmemdup o...

PT-2026-116690

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM during intra-host migration Manually perform cache maintenance on the source VM during intra-host migration to ensure no stale data is left in CPU caches after the VM is destroyed...

PT-2026-116688

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix AArch32 DBGBXVR handling The consolidation of the breakpoint and watchpoint register accessors switched DBGBXVR from trap bvr to trap dbg wb reg. The latter selects backing storage with demux wb reg, which only...

PT-2026-116695

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccw device get util str The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpid to chp can retu...

PT-2026-116697

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 "scsi: ufs: core: Switch to scsi get internal cmd" switched UFS internal commands to allocate requests on hba-host-pseudo sdev-request...

PT-2026-116656

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: fix runtime PM reference leaks Use pm runtime resume and get in iris enable power domains to avoid leaking a runtime PM usage count on failure. Also ensure pm runtime put sync is always called in iris disable...

PT-2026-116659

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvm arch flush shadow all, which is a Bad Ideatm. Freeing the page tables is fair game this is what this callback is...

PT-2026-116851

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending mesh send sync entries on cancel In send cancel, pending mesh tx objects are removed from the hdev-mesh pending list and freed via mesh send complete. However, if a mesh transmission was already...

PT-2026-116854

In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zones cond out-of-bounds write on zone report blk revalidate disk zones sizes the zones cond array from the disk capacity and zone size, but the index used by blk revalidate zone cond comes from the device-driven...

PT-2026-116847

In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After do check returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining...

PT-2026-116855

In the Linux kernel, the following vulnerability has been resolved: squashfs: Add dictionary size range check to prevent shift-out-of-bounds When an abnormal SquashFS image COMP OPTS flag is 1 but dictionary size is 0 is mounted, and performs shift operations using dictionarysize, the shift...

PT-2026-116714

In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arp dev field may contain IFNAMSIZ bytes without a NUL terminator. Such input is passed to dev get by name...

PT-2026-116822

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when clearing stale local source The UDP output fallback clears bind-local in place when the remembered source address is no longer usable. The bind is RCU-published and read locklessly by concurrent TX, so an...

PT-2026-116870

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in dat cond set storage key Some callers pass NULL as oldkey. Calling page cond set storage key will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the...

PT-2026-117036

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add better pm runtime error handling in func probe Add a common error path in probe that balances the runtime PM reference...

PT-2026-116657

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mptcp module where the mptcp write data fin function fails to initialize certain values when sending a DATA FIN without data. Because a DATA FIN occupies one octet...

PT-2026-116782

In the Linux kernel, the following vulnerability has been resolved: net: phylink: record the PHY only once bringup cannot fail phylink bringup phy stores the PHY in pl-phydev before its last fallible step: on a MAC whose phylink ops implement LPI, phy eee rx clock stop can fail with a real MDIO...

PT-2026-116869

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix potential races in dat skey functions When dat cond set storage key finds a large page, it will conditionally set the storage key in absolute memory using large crste to phys to get the absolute address. There is a...

PT-2026-116901

In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidate before server-side copy/clone cifs file copychunk range and the clone FICLONE path of cifs remap file range do not serialise the destination page cache against the server-side copy the way the...

PT-2026-116617

libtta through 2.3 contains a divide-by-zero vulnerability in tta decoder init get info that allows attackers to crash applications by supplying an unvalidated zero sample rate. Attackers can craft a .tta file with a recomputed header CRC32 that triggers SIGFPE, crashing applications including th...

PT-2026-116966

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serial core unregister port port-port dev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serial core port device add...

PT-2026-116874

In the Linux kernel, the following vulnerability has been resolved: perf: Require kernel access for text poke events Perf events with exclude kernel=1 can be opened without kernel perf access. However, exclude kernel does not suppress text-poke sideband records. Every PERF RECORD TEXT POKE is...

PT-2026-116663

In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfs qm flush one fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is...

PT-2026-116835

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: reset num napi when the napi vectors are freed fbn-num napi is the count of live napi vectors, each of which owns an IRQ. The PM path had freed them without clearing the count. fbnic pm suspend tears the datapath down...

PT-2026-117037

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not wake up kswapd in kfree rcu sheaf Since kfree rcu can be called under pi lock a raw spinlock in the scheduler, kfree rcu itself should never allocate memory with GFP KSWAPD RECLAIM as waking up kswapd ends up...

PT-2026-116924

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESH MAX MPATHS. mesh path free rcu decrements the interface...

PT-2026-116967

In the Linux kernel, the following vulnerability has been resolved: serial: 8250 bcm7271: fix use-after-free in brcmuart remove brcmuart handle irq starts priv-hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuart hrtimer fu...

PT-2026-117046

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k htc: bound TX aggregation to MAX TX BUF SIZE hif usb tx dequeues up to MAX TX AGGR NUM 20 frames into a single tx buf of MAX TX BUF SIZE 32768 bytes, limiting the batch by record count but never by cumulative byte...

PT-2026-116790

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: clear stale buf-page after recycling on skb build failure In stmmac rx, when napi build skb fails the descriptor page is recycled back to the page pool with page pool recycle direct, but buf-page is left pointing at...

PT-2026-116811

In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emac tx mem map writes TX DESC 0 OWN into the ring descriptor for every slot beyond old head as soon as that slot's memset'd local copy is committed with "tx desc add...

PT-2026-116740

In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix incorrect RCU teardown order i915 gem busy ioctl uses dma resv for each fence unlocked to iterate over the fences in an GEM object without holding a reference but only the RCU read side lock. What can happen here is...

PT-2026-117153

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Creating a draft release through the API returns an assets list generated from a release lacking an ID. This causes the system to match every attachment not link...

PT-2026-116945

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups a...

PT-2026-116757

In the Linux kernel, the following vulnerability has been resolved: writeback: bound cleanup offline cgwb rescans by rotating scanned inodes cleanup offline cgwb prepares at most WB MAX INODES PER ISW inodes per call and is called again until the dying wb is drained, but every call walks wb-b...

PT-2026-116939

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified Force a refresh of the vmcs02 MSR bitmap during nested VM-Enter if the runtime eVMCS controls pin, primary, secondary, etc. are being updated. If L1 isn't...