UBUNTU-CVE-2026-74534

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of isoconn isoconndel and isochandel have a race that results to double-put of isoconn: Task hdev-workqueue Task 2 isoconndel isochandel isoconnholdunlesszero isoconnlock isoconnlock conn-sk = NULL...

UBUNTU-CVE-2026-74489

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix tidtx use-after-free on BA session stop ieee80211stoptxbacb hands tidtx to kfreercu through ieee80211removetidtx, and then reads tidtx-ndp after dropping sta-lock: ieee80211removetidtxsta, tid; / kfreercutidtx...

UBUNTU-CVE-2026-74524

In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove removepudmapping and removep4dmapping obtain a child table base with pudoffsetp4dp, 0 and p4doffsetpgd, 0, then add the index for addr. RISC-V folds page-table...

UBUNTU-CVE-2026-74500

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix stack info leak in RME Digiface status sndrmedigifacereadstatus reads a four-word status block from the device into an uninitialised on-stack le32 buf4 and, whenever the vendor control-IN transfer does not...

UBUNTU-CVE-2026-74463

In the Linux kernel, the following vulnerability has been resolved: i2c: jz4780: Cache host clock rate at probe to prevent CCF preparelock deadlock Fix a severe AB/BA deadlock between the Common Clock Framework CCF and the I2C adapter lock, which triggers when an I2C-controlled clock generator...

UBUNTU-CVE-2026-74448

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix QID bit leak in pqmcreatequeue When MES is enabled and amdgpuamdkfdallockernelmem fails during the first queue creation for a process, pqmcreatequeue returns early via 'return retval' without going through the...

UBUNTU-CVE-2026-74511

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix pending command UAF in EIR updates MGMTOPSETLOCALNAME is handled asynchronously on powered controllers and can run setnamesync. When the controller is BR/EDR capable, setnamesync updates the local name and th...

UBUNTU-CVE-2026-74546

In the Linux kernel, the following vulnerability has been resolved: hwmon: adt7470 Fix divide-by-zero TOCTOU crash in fan speed read If the fan data becomes 0 between the FANDATAVALID check and the FANPERIODTORPM conversion, it will result in a divide-by-zero crash due to a race with a concurrent...

UBUNTU-CVE-2026-74522

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode. ksmbdclosefd currently marks the file closed a...

UBUNTU-CVE-2026-74468

In the Linux kernel, the following vulnerability has been resolved: gpio: pch: use rawspinlockt for the register lock pchirqtype is registered as the irqchip .irqsettype callback and takes chip-spinlock with spinlockirqsave. This callback is reached from setupirq - irqsettrigger - chip-irqsettype...

UBUNTU-CVE-2026-74465

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix potential UAF on meter attach failure While attaching a newly created meter attachmeter function makes the new meter visible to other CPUs but can still fail afterwards. On failure, it detaches the meter bac...

UBUNTU-CVE-2026-74459

In the Linux kernel, the following vulnerability has been resolved: can: etases58x: es58xreadbulkcallback: fix RX buffer leak on URB resubmit failure es58xreadbulkcallback resubmits the RX URB after processing a received packet. If the resubmit succeeds, the URB remains anchored and will be handl...

UBUNTU-CVE-2026-74521

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

UBUNTU-CVE-2026-74464

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix skb leak on flow key update failure during ct ovsctexecute always steals or frees the skb on failure while ovsflowkeyupdate does not. So, if it fails and we return right away, the skb ends up leaked. Fix tha...

UBUNTU-CVE-2026-74462

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: mark I2C adapter when hardware is powered down On some i.MX platforms, certain I2C client drivers keep a periodic workqueue which continues to trigger I2C transfers. During system suspend/resume, there exists a time...

UBUNTU-CVE-2026-74506

In the Linux kernel, the following vulnerability has been resolved: afs: Fix UAF when sending a message In afsmakecall, there's a race with async call reception and destruction. If a call is dispatched that doesn't have call-writeiter set used to specify the data content for FS.StoreData, then th...

UBUNTU-CVE-2026-74442

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: avoid destroyworkqueueNULL on vkms init failure Two paths through vmwvkmsinit can leave vmw-crcworkq NULL while still leaving the rest of the driver in a state that calls vmwvkmscleanup at module unload: 1...

UBUNTU-CVE-2026-74532

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Validate length before parsing diagnostics TLV btinteldiagnostics accesses tlv-val0 without first validating that the diagnostics VSE is long enough to contain that field, so may cause reading data beyond the...

UBUNTU-CVE-2026-74517

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs Cancel and flush the I/O APIC's delayed EOI handling work during the "pre VM destroy" phase, before vCPUs are destroyed, as processing the EOI broadcast will...

UBUNTU-CVE-2026-74530

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectbigsync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to match the previo...