CVE-2026-72023

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix SQB pointer leak on init failure otx2inithwresources initializes SQ aura and pool resources before several later setup steps. On failure, errfreesqptrs only frees SQB pages, leaving the per-SQ sqbptrs arrays...

CVE-2026-72022

In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llcuiautobind llcuiautobind opens a SAP after choosing a dynamic LSAP. llcsapopen returns a reference owned by the caller, and llcsapaddsocket takes a second reference for the socket's membership in...

CVE-2026-72021

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

UBUNTU-CVE-2026-72141

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 IRQ SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next...

UBUNTU-CVE-2026-72068

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Use u64 multiplication in updaterlimitcpu updaterlimitcpu converts the RLIMITCPU value to nanoseconds with u64 nsecs = rlimnew NSECPERSEC; On 32-bit kernels both rlimnew unsigned long and NSECPERSEC 1000000000L...

UBUNTU-CVE-2026-72199

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident index root values on lookup Resident $INDEXROOT values carry index header fields that callers consume after lookup. Some callers already validate parts of the layout before walking entries, but those check...

UBUNTU-CVE-2026-72093

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix use-after-free in amdxdnagemdmabufmmap When vminsertpages fails, the error path calls vma-vmops-closevma which internally calls drmgemvmclose → drmgemobjectput, releasing the GEM object reference acquired at th...

UBUNTU-CVE-2026-72041

In the Linux kernel, the following vulnerability has been resolved: espintcp: use skmsgfreepartial to fix partial send skmsgfreepartial ensures consistency of the skmsg at every iteration, without having to manually handle uncharges and offsets. This simplifies the code, and fixes some bugs in...

UBUNTU-CVE-2026-72186

In the Linux kernel, the following vulnerability has been resolved: ntfs: make system files immutable to prevent corruption When a system file such as $Bitmap is exposed via showsysfiles and written from userspace, the volume is corrupted and, because the cluster allocator scans $Bitmap through t...

UBUNTU-CVE-2026-72119

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcmtxlock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there, mirroring the approach already used in bcmrxsetup. Only copy the validat...

UBUNTU-CVE-2026-72099

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: don't increment hashoffset twice hashoffset is already incremented in the loop "for i = 0; i tocopy; i++, ts--". Do not increment it again...

UBUNTU-CVE-2026-72137

In the Linux kernel, the following vulnerability has been resolved: xfrm: natkeepalive: avoid double free on send error natkeepalivesend frees the keepalive skb whenever the IPv4 or IPv6 send helper reports an error. That cleanup is only correct before the skb is handed to the output path. Once...

UBUNTU-CVE-2026-72032

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, fix matcher leak on resize target setup failure hwsbwcmatchermove allocates a replacement matcher before setting it as the resize target. If mlx5hwsmatcherresizesettarget fails, the replacement matcher is not...

UBUNTU-CVE-2026-72269

In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: fix potential memory leak in uvesafbprobe Due to an incorrect goto label, memory allocated for modedb and modelist in uvesafbvbeinit is not freed in some error paths. Fix this by updating the goto label...

UBUNTU-CVE-2026-72252

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nftpipapomatch can enter a bad state: - some fields can have their lookup tables resized while others did not - bits...

UBUNTU-CVE-2026-72021

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

UBUNTU-CVE-2026-72185

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix WARNON for resident attribute in ntfsmaprunlistnolock When ntfsmaprunlistnolock needs to look up the attribute extent containing a target VCN ctxneedsreset == true, it calls ntfsattrlookup and then expects the result to...

UBUNTU-CVE-2026-72115

In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op ifindex == 0 with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces:...

UBUNTU-CVE-2026-72174

In the Linux kernel, the following vulnerability has been resolved: fs/proc/taskmmu: fix hugetlb self-deadlock in pagemapscanptehole A PAGEMAPSCAN ioctl requesting PMSCANWPMATCHING on a hugetlb VMA hangs the calling thread, unkillably, as soon as the scan reaches an unpopulated part of the range:...

UBUNTU-CVE-2026-72045

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvumboxhandlerlmtsttblsetup uses req-basepcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into th...