PT-2026-117077

In the Linux kernel, the following vulnerability has been resolved: io uring: fix task work add use-after-free with SQPOLL For SQPOLL, the sqpoll thread runs task work off its own list and doesn't need to be told about it, so it can pop and complete a request as soon as mpscq push has published i...

PT-2026-117051

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkg tryget closest bio set dev associates the bio with a blkg through bio associate blkg. If the blkg lookup misses, blkg tryget closest takes q-queue lock with spin lock irq and releases it with sp...

PT-2026-117082

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Re-pend GET NESTED STATE PAGES if getting said pages fails Re-pend GET NESTED STATE PAGES before exiting to userspace if getting the nested pages fails in the KVM RUN path. If userspace re-runs the vCPU, and vmcs02 hold...

PT-2026-116950

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel pcie: fix plen overflow in btintel pcie recv frame plen is u16 and computed as HDR SIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value = 0xFFFC wraps the sum, bypassing the "skb-len plen" check a...

PT-2026-117069

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TX RING byte count overflow tpacket snd drains every SEND REQUEST frame in a TX ring and adds each valid packet length to the signed int len sum. Userspace can recycle completed frames concurrently, so a singl...

PT-2026-117023

In the Linux kernel, the following vulnerability has been resolved: net: page pool: fix use-after-free in page pool recycle ring bulk With CONFIG PAGE POOL STATS=y, page pool recycle ring bulk updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmem...

PT-2026-116761

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Return PERR NOCPUS in remote partition enable on subpartitions cpus conflict When a remote partition is created underneath an existing local partition via a non-partition PRS MEMBER intermediate cgroup, update...

PT-2026-116987

In the Linux kernel, the following vulnerability has been resolved: usb: typec: anx7411 - stop the IRQ before destroying the workqueue The IRQ is devm-managed, so it can still queue plat-work while remove is tearing the queue down. Disable it first...

PT-2026-117001

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix ovl adaptor platform device leak mtk drm probe creates an OVL adaptor platform device with platform device register data when the display pipeline requires the OVL adaptor. If a later initialization step fails,...

PT-2026-116653

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A range check was missing in the proc dointvec ms jiffies minmax function within the sysctl component. This occurred because a previous update to replace the SYSCTL INT CONV CUSTOM macro...

PT-2026-117008

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in free by rcu ttrace do call rcu ttrace returns early when call rcu ttrace in progress is set and leaves the objects in free by rcu ttrace. free rcu frees waiting for gp ttrace only and clears the flag...

PT-2026-117053

In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails after the user OTP NVMEM device has been registered, mtd otp nvmem add unregisters the user device but leaves mtd-otp user nvmem set. On an error, the...

PT-2026-116948

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Don't apply va align to hugetlb mappings on AMD F15h get align mask returns huge page mask align for hugetlbfs, but get align bits adds va align.bits regardless, so vm unmapped area returns an address off the huge page...

PT-2026-116912

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Hold a router reference for each allocated HopID tb stop drops the reference to all DP tunnels but does not deactivate them, thus nothing cancels a dprx work still in flight which holds its own tunnel reference and t...

PT-2026-116974

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vcc send ctl The stack-allocated struct vio vcc pkt was partially initialized, leaving the tag.stype env field uninitialized before being sent via ldc write, potentially leaking kernel...

PT-2026-117040

In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCB HAS METADATA leaves iocb-private as a uio meta, while iocb bio iopoll expects a bio. Since 2729a60bbfb9, metadata I/O always uses blkdev direct IO, which never publishes...

PT-2026-116814

In the Linux kernel, the following vulnerability has been resolved: udp: remove a disconnected socket from the 4-tuple hash table A UDP socket bound to a specific address and port keeps its entry in the 4-tuple hash table after it is disconnected: sk binds to 127.0.0.1:21001 sk connects to...

PT-2026-117052

In the Linux kernel, the following vulnerability has been resolved: mtd: core: call get device with the master MTD get mtd device calls the master's get device callback with mtd, which may be a partition. put mtd device passes the master. This breaks gluebi partitions because gluebi get device us...

PT-2026-116774

In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llc mac hdr init failure In llc conn ac resend i xxx x set 0 or send rr, if llc mac hdr init fails, kfree skbskb is called instead of kfree skbnskb. This leaks the newly allocated nskb, reads from th...

PT-2026-116595

Missing Authorization vulnerability in Kit Kit formerly ConvertKit convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit formerly ConvertKit: from n/a through 3.4.6...

PT-2026-117088

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This issue affects the function Exam::startExam of the file exam.php of the component Exam Module. The manipulation of the argument topicid results in sql injection. The attack...

PT-2026-117078

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: stop the release timer from being rearmed on remove mt remove quiesces the sticky-finger timer before stopping the hardware: timer delete sync&td-release timer; sysfs remove group&hdev-dev.kobj, &mt attribute...

PT-2026-116733

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validate init On the ttm bo reserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drm gem objec...

PT-2026-116850

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xsk map gen lookup xsk map gen lookup loads a u32 key and compares it with max entries using BPF JMP IMM. BPF immediates are sign-extended to 64 bits, so a max entries value of 0x80000000 or higher...

PT-2026-116559

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges Subscriber and above to perform SQL injection...

PT-2026-116756

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current pwq deref in flush dependency check check flush dependency uses current wq worker to determine whether the caller is a workqueue worker and then dereferences worker-current pwq to test whether the...

PT-2026-116745

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the llc alloc frame function where link-layer headroom is reserved based solely on the device type. This approach is insufficient for stacked Ethernet devices, such as...

PT-2026-116916

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix dynamic id driver deregistration race Only free the dynamic ids after having deregistered the driver and removed the "new id" attribute to avoid leaking any id added by a racing write to the attribute...

PT-2026-116737

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: pin VRAM for the whole registered range Commit c32287471077 "gpu/drm/nouveau: enable THP support for GPU memory migration" grew the device-private region that nouveau dmem chunk alloc registers from DMEM CHUNK...

PT-2026-116683

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears next set before its final uses of the enclosing vCPU. If teardown observes next set as false while the callback is still running, kvm...

PT-2026-116803

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in em text dump em text dump allocates struct tcf em text on the stack without zeroing it. strscpy writes the algorithm name and a NUL terminator into conf.algo, leaving the remaining bytes...

PT-2026-116612

libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng read ordr that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a...

PT-2026-116794

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533 acr122 is rx frame valid frame-ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame-data. A malicious or malfunctioning device can set this field ...

PT-2026-116938

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it Nullify have run cpus when freeing the mask, particularly in the error path of sev guest init, so that KVM doesn't have to subtly use sev-active to track whether or n...

PT-2026-116942

In the Linux kernel, the following vulnerability has been resolved: nvmet: copy the hostid into the ctrl before creating PR pc refs Commit 6202783184bf "nvmet: Improve nvmet alloc ctrl interface and implementation" added a second uuid copy of args-hostid near the end of nvmet alloc ctrl, and comm...

PT-2026-116911

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Make the DP tunnel activation callback mandatory tb tunnel alloc dp takes an optional callback which is run from dprx work once the DPRX capabilities read has completed. Without that callback tb dp dprx start reads t...

PT-2026-116931

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Take a refcount on IRQs referenced by last lr irq Referencing the last interrupt inserted in an LR is rather fragile, as this interrupt can vanish if a concurrently unmapped LPI. Solve this by bumping up the...

PT-2026-116649

A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1...

PT-2026-117028

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: don't drain cmd sync backlog on unregister hci unregister dev disables cmd work and cmd timer, then calls hci cmd sync clear, whose cancel work sync waits for hci cmd sync work to return. That worker dequeues...

PT-2026-116919

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set info-band for 802.3 encap offload frames Unlike the 802.11 TX paths, ieee80211 8023 xmit does not set info-band from the channel context on non-MLD interfaces. It stays at 0, so ieee80211 get tx rates uses the...

PT-2026-116658

In the Linux kernel, the following vulnerability has been resolved: smb/server: cancel async requests when closing connection An async request may still be waiting when a connection is closed. This can stop the connection from closing. Cancel active async requests before waiting for them to finis...

PT-2026-116864

In the Linux kernel, the following vulnerability has been resolved: HID: winwing: fix use-after-free in force feedback teardown winwing init ff passes the driver's private data, allocated with devm kzalloc in winwing probe, as the effect context to input ff create memless. The memoryless...

PT-2026-116553

The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type,...

PT-2026-116858

In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entry update order The SBI v3.0 specification section 15.1.2 requires a nested HFENCE entry to be populated as follows: 1 find an unused entry with Config.Pending == 0 2 update the Page Number and Page...

PT-2026-116616

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in tta decoder process stream and tta decoder process frame because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache-1 wi...

PT-2026-116610

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL EXPORTER OTLP CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or...

PT-2026-116603

Name of the Vulnerable Software and Affected Versions Vanus versions 0.8.0 through 0.9.0 Description An authentication flaw exists in the gateway CloudEvents HTTP receiver, allowing unauthenticated remote attackers to publish events to any eventbus. Attackers can bypass token authentication and...

PT-2026-116984

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronize irq by waiting until its private callback usage counter drops to 0 with the private lock not held. This counter is...

PT-2026-116776

In the Linux kernel, the following vulnerability has been resolved: gve: DQO: fix header length used by gve can send tso for UDP GSO gve can send tso computes how many buffers each segment of a GSO packet would span, and for this it needs the length of the headers that the device replicates in...

PT-2026-117026

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/mlx5 module where the mlx5 handle changeupper event and mlx5 handle changeinfodata event functions incorrectly call bonding-specific APIs when handling team...