UBUNTU-CVE-2026-72217

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdrbuftobvec stores before writing xdrbuftobvec writes a biovec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When the...

CVE-2026-72017

In the Linux kernel, the following vulnerability has been resolved: net: macb: drop in-flight Tx SKBs on close The MACB driver has since forever leaked the outgoing SKBs that have not yet been marked as completed. They live in queue-txskb which gets freed without remorse nor checking...

CVE-2026-72020

In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ipvsseq structs in ipvsconnnew Commit 9a05475cebdd "ipvs: avoid kmemcachezalloc in ipvsconnnew" changed ipvsconnnew to allocate an ipvsconn object with kmemcachealloc. The function then initializes many fields...

UBUNTU-CVE-2026-72275

In the Linux kernel, the following vulnerability has been resolved: fbdev: broadsheetfb: fix potential memory leak in broadsheetfbprobe The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. Fix it by calling fbdeferrediocleanup...

UBUNTU-CVE-2026-72228

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: fix primaryif leak on failed linearization If the skb has a fraglist, it must be linearized before it can be split using skbsplit. But when this step failed, it must not only free the skb but also take care of t...

UBUNTU-CVE-2026-72096

In the Linux kernel, the following vulnerability has been resolved: dm-verity: make error counter atomic The error counter "v-corruptederrs" was not atomic, thus it could be subject to race conditions. The call to dmauditlogtarget"max-corrupted-errors" may be skipped due to the races...

UBUNTU-CVE-2026-72169

In the Linux kernel, the following vulnerability has been resolved: kho: make sure scratch size is always aligned by CMAMINALIGNMENTBYTES When using scratchscale, the scratch sizes are rounded up to CMAMINALIGNMENTBYTES since they will be released as MIGRATECMA. This is not done when using fixed...

UBUNTU-CVE-2026-72037

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Initialize ethsyslock spinlock before use lan743xhardwareinit calls pci11x1xstrapgetstatus during the PCI11x1x probe sequence. That helper acquires the Ethernet subsystem hardware lock via lan743xhssyslockacquire,...

UBUNTU-CVE-2026-72019

In the Linux kernel, the following vulnerability has been resolved: macsec: don't read an unset MAC header in macsecencrypt macsecencrypt reads the Ethernet header via ethhdrskb skb-head + skb-macheader to memmove the 12 source/destination MAC bytes forward and make room for the SecTAG. On the...

UBUNTU-CVE-2026-72113

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing device refcount for CAN filter removal sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6...

UBUNTU-CVE-2026-72078

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - validate control endpoint type The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint...

UBUNTU-CVE-2026-72160

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject dinodes with non-canonical imode type Patch series "ocfs2: harden inode validators against forged metadata", v2. This series adds three structural checks to OCFS2 dinode validation so malformed on-disk fields are...

UBUNTU-CVE-2026-72075

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix race condition in resetdevice sysfs callback The imspcuresetdevice sysfs callback calls imspcuexecutecommand without acquiring pcu-cmdmutex. This can lead to data races and corruption of the shared command...

UBUNTU-CVE-2026-72053

In the Linux kernel, the following vulnerability has been resolved: net: ipip: require CAPNETADMIN in the device netns for changelink ipipchangelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than t...

UBUNTU-CVE-2026-72129

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmetrdmauseinlinesg maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len offset = off;...

UBUNTU-CVE-2026-72216

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: Fix leak when custom dumpsegments addition fails Free allocated minidumpregion 'name' in qcomaddminidumpsegments when failing before adding the region to 'dumpsegments'. Otherwise, the 'name' is not tracked and ...

UBUNTU-CVE-2026-72203

In the Linux kernel, the following vulnerability has been resolved: ntfs: skip extent mft records in writeback to prevent deadlock This patch fixes the ABBA deadlock between extentlock and extent mreclock triggered by xfstests generic/113, that occurs since the commit 6994acf33bae "ntfs: use base...

UBUNTU-CVE-2026-72155

In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: swp: Improve locking user experience In the case of the first block being locked or the few first blocks, if the user want to fully unlock the device it has two possibilities: - either it asks to unlock the entire...

UBUNTU-CVE-2026-72039

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix potential memory leak in bnx2xallocmembp If the allocation of fpi.tpainfo fails, the error path will not free the struct bnx2xfastpath allocated earlier, as it is not linked to the bp structure yet. Fix that by linking...

UBUNTU-CVE-2026-72085

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded secmd has only been memset to 0, so its cmdkref is 0; the secmd is...