CVE-2026-98596

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6routeoutputflags, ip6rtputflags, and ip6dstcheck detect an uncached route by listempty&rt-dst.rtuncached, which replaced the static DSTNOCACHE flag check in commit a4c2fd7f7891 "net:...

CVE-2026-98733

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize fragmented ISO packet queueing The fragmented path in hciqueueiso calls skbqueuetail without holding conn-dataq.lock. The socket lock serializes senders, but the transmit worker can concurrently remo...

CVE-2026-98703

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrelht: validate fixed rate index The fixedrateidx debugfs file is a plain u32 attribute, so any value can be written to it. minstrelhtupdatestats then copies the value into mi-maxtprate and mi-maxprobrate, an...

CVE-2026-98688

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL dereference in tbremovework There is a slight race between tbremovework and tbdomainremove which leads to dereferencing a NULL tb-rootswitch pointer inside tbfreeunpluggedxdomains: Thread A Thread B...

CVE-2026-98522

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvrmmumapsgl Map failure from pvrmmumapsgl interface was not returned correctly to pvrmmumap interface. This resulted in pvrmmumap interface to continue instead of returning ...

CVE-2026-98620

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: unregister netdevices in case of probe failure If registernetdev fails for one of the MTKMAXDEVS devices in mtkprobe, the error path jumps to errdeinitppe, skipping mtkunregdev. The previously registered...

CVE-2026-98455

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

UBUNTU-CVE-2026-98678

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4030: fix invalid oversamplingratio validation In ad4030setavgframelen, the logarithm is calculated before input validation. Passing zero or negative values leads to an undefined result from ilog2. Validate that the...

UBUNTU-CVE-2026-98693

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Hold a router reference for each allocated HopID tbstop drops the reference to all DP tunnels but does not deactivate them, thus nothing cancels a dprxwork still in flight which holds its own tunnel reference and the...

UBUNTU-CVE-2026-98623

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkmclkustateupdate If listforeachentry exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead. The check is reachable fr...

UBUNTU-CVE-2026-98491

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1...

UBUNTU-CVE-2026-98596

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6routeoutputflags, ip6rtputflags, and ip6dstcheck detect an uncached route by listempty&rt-dst.rtuncached, which replaced the static DSTNOCACHE flag check in commit a4c2fd7f7891 "net:...

UBUNTU-CVE-2026-98723

In the Linux kernel, the following vulnerability has been resolved: nvmet: copy the hostid into the ctrl before creating PR pcrefs Commit 6202783184bf "nvmet: Improve nvmetallocctrl interface and implementation" added a second uuidcopy of args-hostid near the end of nvmetallocctrl, and commit...

UBUNTU-CVE-2026-98612

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catcrxdone catcrxdone walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pktlen urb-actuallength, ignores the header offset and compares against t...

UBUNTU-CVE-2026-98631

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...

UBUNTU-CVE-2026-98496

In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdtwork after releasing the WDT IRQ airohanpuremove calls cancelworksync on each core's wdtwork, but the watchdog IRQ that queues it is requested with devmrequestirq and is freed only after .remove return...

CVE-2026-98700

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set info-band for 802.3 encap offload frames Unlike the 802.11 TX paths, ieee802118023xmit does not set info-band from the channel context on non-MLD interfaces. It stays at 0, so ieee80211gettxrates uses the wron...

CVE-2026-98685

In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via clone range cifsremapfilerange discarded the pagecache only for the folios overlapping the destination region, so when a clone extends the file the folio straddlin...

CVE-2026-98638

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Validate the SVE vector length in pkvmvcpuinitsve pkvmvcpuinitsve clamps only the upper bound of the host-provided svemaxvl, so an invalid vector length reaches svestatesizefromvl and the WARNON there, which is fatal ...

CVE-2026-98853

In the Linux kernel, the following vulnerability has been resolved: net: gso: limit recursive IP-in-IP segmentation IP-in-IP GSO can re-enter inetgsosegment or ipv6gsosegment for each nested IP header. encaplevel tracks header bytes, not callback depth, so a deep chain can exhaust the kernel stac...