CVE-2026-98718

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM before clearing SEV state Explicitly flush caches after intra-host migration before clearing "SEV active" on the source VM, as doing cache maintenance afterwards creates a tiny wind...

CVE-2026-98756

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3pciprobe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pcisetdrvdata, while the second function...

CVE-2026-98681

In the Linux kernel, the following vulnerability has been resolved: smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races The invalidHandle, swapfile, oplockbreakcancelled, offload, and statusfiledeleted fields are stored in the same bitfield byte in struct cifsFileInfo, but ar...

CVE-2026-98778

In the Linux kernel, the following vulnerability has been resolved: binder: fix isfailure flag for superseded transaction cleanup When a TFUPDATETXN transaction supersedes a pending async transaction, binderreleaseentirebuffer is called with isfailure=false. Since the superseded transaction was...

CVE-2026-98866

In the Linux kernel, the following vulnerability has been resolved: sched/cache: Introduce taskstruct-schedcachegrp to fix UAF Add a schedcachegrp pointer to taskstruct so that scheduler code can access the cache group directly via the task, without going through mm-schedcachegrp. This decouples...

CVE-2026-98857

In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ipvslblcrnew and ipvslblcnew create cache entries for every previously unseen destination address. The table maxsize only tells the periodic collector to reclaim entries after the cache has...

CVE-2026-98839

In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in pasteselection In pasteselection, the loop copies mintunsigned int, vcsel.buflen - pasted,tty-receiveroom bytes per iteration into ttyldiscreceivebuf and...

Linux Distros Unpatched Vulnerability : CVE-2026-98501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: alps: fix use-after-free on input2 registration failure alpsinputconfigured stores data-input2 before calling inputregisterdevice. If registration fails,...

UBUNTU-CVE-2026-98716

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted Use the MSR permission bitmap of the active VMCB instead of assuming that KVM is always using vmcb02's bitmap when L2 is active, as KVM uses msrpm02 i...

UBUNTU-CVE-2026-98455

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

CVE-2026-98753

In the Linux kernel, the following vulnerability has been resolved: tty: ttyport: restore TTYIOERROR on activation failure Make sure to restore the TTYIOERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel panic...

UBUNTU-CVE-2026-98794

In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received in the backup server While the IPVS SYNC protocol is not secure by design we can still protect the backup server from messages that can wreak havoc. This commit addresses problems from received...

UBUNTU-CVE-2026-98627

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe regsafe maps packet pointer IDs between states and checks that each current register range is a subset of the corresponding explored register range. It does not, however,...

CVE-2026-98717

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

UBUNTU-CVE-2026-98750

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being...

UBUNTU-CVE-2026-98597

In the Linux kernel, the following vulnerability has been resolved: net: usb: sr9700: include receive overhead in the length check The receive fixup subtracts the Ethernet CRC from the reported packet length, but compares that payload length against the whole remaining receive buffer. The followi...

UBUNTU-CVE-2026-98796

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev eth-dummydev. mtkprobe creates that dummy device, and adds the shared tx/rx NAPI to it, only after...

UBUNTU-CVE-2026-98756

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3pciprobe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pcisetdrvdata, while the second function...

CVE-2026-98752

In the Linux kernel, the following vulnerability has been resolved: tty: port: fix ttyportttyvhangup race Drivers rely on ttyportttyvhangup to synchronously hang up their ports before tearing down resources as part of deregistration e.g. on physical disconnect. If ttyportttyvhangup races with...

UBUNTU-CVE-2026-98629

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it und...