UBUNTU-CVE-2026-98661

In the Linux kernel, the following vulnerability has been resolved: iio: light: rohm-bu27034: Fix infinite delay on error When reading an integration-time fails, the code will use error code to compute the sleep time. Fix this by using the smallest integration time as a default if reading fails...

Linux Distros Unpatched Vulnerability : CVE-2026-98440

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvmarchflushshadowall, which is a Bad Ideatm...

UBUNTU-CVE-2026-98645

In the Linux kernel, the following vulnerability has been resolved: HID: winwing: fix use-after-free in force feedback teardown winwinginitff passes the driver's private data, allocated with devmkzalloc in winwingprobe, as the effect context to inputffcreatememless. The memoryless force-feedback...

CVE-2026-98531

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6ATTRDST In seg6genlpolicy, SEG6ATTRDST is defined with .type = NLABINARY and .len = sizeofstruct in6addr. For NLABINARY, .len only enforces the maximum payload length and permits...

CVE-2026-98470

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode kvmpkvmioctlallowed WARNs when kvmgetcapforkvmioctl doesn't find the ioctl number in vmioctlcaps, and kvmarchvmioctl calls it for every number the generic code doesn...

CVE-2026-98485

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6trt: fix zero-address non-strict match out-of-bounds read rtmt6check permits rules to be configured with rtinfo-addrnr == 0 even when address matching IP6TRTFSTMASK is requested. In the IP6TRTFSTNSTRICT path, rtmt6...

CVE-2026-98828

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9kwmirspcallback removes the validated WMI header and copies the number of bytes expected by the waiting command into its response buffer. A device response shorter than that...

CVE-2026-98794

In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received in the backup server While the IPVS SYNC protocol is not secure by design we can still protect the backup server from messages that can wreak havoc. This commit addresses problems from received...

CVE-2026-98693

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Hold a router reference for each allocated HopID tbstop drops the reference to all DP tunnels but does not deactivate them, thus nothing cancels a dprxwork still in flight which holds its own tunnel reference and the...

CVE-2026-98565

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 The core and io supplies are only requested for IDMT7530: both the devmregulatorget in probe and the regulatorenable in mt7530setup are guarded by the switch i...

CVE-2026-98682

In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidate before server-side copy/clone cifsfilecopychunkrange and the clone FICLONE path of cifsremapfilerange do not serialise the destination page cache against the server-side copy the way the other...

CVE-2026-98728

In the Linux kernel, the following vulnerability has been resolved: tpm: fix off-by-four bounds check in tpm2getrandom When the response carries the TPM2STSESSIONS tag, tpm2getrandom skips the 4-byte parameter size field before locating the random data, but the bounds check still validates the...

CVE-2026-98737

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix inquiry cache use-after-free The sync command worker holds hdev-reqlock, but inquiry-cache updates and flushes use hdev-lock. Both hciaclcreateconnsync and hcistopdiscoverysync look up entries and read the...

CVE-2026-98724

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nrdescs zero, so nvmetpciepfgetsglsegment reads the type byte of sgls-1 outside the...

CVE-2026-98824

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate TX status rate metadata minstrelhttxstatus converts the HT/VHT rate reported in a TX status into a group and rate index and uses those to index the minstrelht rate tables. The existing validation only...

CVE-2026-98639

In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entry update order The SBI v3.0 specification section 15.1.2 requires a nested HFENCE entry to be populated as follows: 1 find an unused entry with Config.Pending == 0 2 update the PageNumber and...

CVE-2026-98750

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being...

UBUNTU-CVE-2026-98702

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject invalid 320 MHz CSA bandwidth The HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a received CSA frame on a non-6 GHz link. It warns for this unsupported width but...

UBUNTU-CVE-2026-98848

In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Assign .num before accessing .hws Commit f316cdff8d67 "clk: Annotate struct clkhwonecelldata with countedby" annotated the hws member of 'struct clkhwonecelldata' with countedby, which informs the bounds sanitizer...

UBUNTU-CVE-2026-98633

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix skb leak in nxpprocessfwdump When CONFIGDEVCOREDUMP=n, hcidevcdappend returns -EOPNOTSUPP without freeing its skb argument. This leaks the cloned skb and also prevents nxpsetindreset from being called to...