CVE-2026-98900

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntallocioctlalloc allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so rejec...

UBUNTU-CVE-2026-98905

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfdqueueacquirebuffers was split off from setqueuepropertiesfromuser, setqueuepropertiesfromcriu was missed. Thus, setqueuepropertiesfromcriu is not filling out the...

CVE-2026-98887

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: reject undersized HWSIMATTRTXINFO hwsimtxinfoframereceivednl casts the HWSIMATTRTXINFO payload to a struct hwsimtxrate and unconditionally reads IEEE80211TXMAXRATES entries 8 bytes from it. The policy only...

CVE-2026-98880

In the Linux kernel, the following vulnerability has been resolved: ntfs3: handle setblocksize failures ntfs3 uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-98882

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for decoutputinfo If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a range check for that. This fixes this smatch error:...

CVE-2026-98903

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imxmuisr imxmushutdown imxmuxcrrmwpriv, IMXMURCR, 0, IMXMUxCRRIEnpriv-dcfg-type, cp-idx; imxmuspecificrx...

CVE-2026-98911

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2switchrx In case of an error in dpaa2switchrx, the dpaa2switchfreefd function is called in order to free the FD. This is incorrect since the dpaa2switchfreefd is intended to be used on Tx...

UBUNTU-CVE-2026-98893

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate SENSORUPDATE payload size SENSORUPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not...

CVE-2026-98888

In the Linux kernel, the following vulnerability has been resolved: arm64: kprobes: Allow reentering kprobes while single-stepping A kprobe can be hit while another kprobe is in KPROBEHITSS state. This can happen when tracing or perf code runs from the debug exception path while the first kprobe ...

CVE-2026-98895

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Handle destroying table that has a miss table If a table has a miss table that was created by 'mlx5hwstablesetdefaultmiss' API function, its misstbl keeps the table that points to it in a list. If such table is...

CVE-2026-98901

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix lease break and ack state handling Do not skip valid lease states containing WRITECACHING when breaking level-II/read leases for writes and truncates. Handle lease break acknowledgments according to the SMB2 rule that...

UBUNTU-CVE-2026-98888

In the Linux kernel, the following vulnerability has been resolved: arm64: kprobes: Allow reentering kprobes while single-stepping A kprobe can be hit while another kprobe is in KPROBEHITSS state. This can happen when tracing or perf code runs from the debug exception path while the first kprobe ...

CVE-2026-98916

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change When trying to do a color change, validate that the link is beaconing first, to avoid calling the driver with an invalid link...

UBUNTU-CVE-2026-98885

In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which...

UBUNTU-CVE-2026-98873

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackexpect: zero at allocation time There are occasional LLM hints wrt. leaking uninitialized data to userspace via ctnetlink. Just zero at allocation time, expectations are not frequently used these days...

CVE-2026-98875

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/gsp: add SEC2 to GA100 chip table The booter-load and booter-unload firmware run on the SEC2 falcon. During tu102gsponeinit, the booter constructor needs device-sec2 to access the SEC2 falcon. Without the .sec2 entry,...

CVE-2026-98897

In the Linux kernel, the following vulnerability has been resolved: ksmbd: don't hold ci-mlock while waiting for a lease break ack When a cifs.ko client caches a read-handle RH lease via deferred close and a conflicting open arrives, ksmbd breaks the lease and waits for the acknowledgment in...

UBUNTU-CVE-2026-98894

In the Linux kernel, the following vulnerability has been resolved: drm/amd/ras: reset CPER ring on corrupt entry size When CPER ring overflow handling advances the read pointer, it trusts the parsed entry size from the current ring contents. Corrupt CPER data can produce an entry size that does...

UBUNTU-CVE-2026-98897

In the Linux kernel, the following vulnerability has been resolved: ksmbd: don't hold ci-mlock while waiting for a lease break ack When a cifs.ko client caches a read-handle RH lease via deferred close and a conflicting open arrives, ksmbd breaks the lease and waits for the acknowledgment in...

UBUNTU-CVE-2026-98883

In the Linux kernel, the following vulnerability has been resolved: serial: 8250port: recognize UPIOAU My MIPS Alchemy systems generate the following warning during probe of the 8250 driver: WARNING: drivers/tty/serial/8250/8250port.c:462 at setiofromupio+0xfc/0x124, CPU0: swapper/0/1 Unsupported...