UBUNTU-CVE-2026-98854

In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered ofoverlayfdtapply stores the idralloc return value in ovcs-id before checking it. On failure the stored id is negative, freeoverlaychangeset's "if ovcs-id" check passes...

UBUNTU-CVE-2026-98531

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6ATTRDST In seg6genlpolicy, SEG6ATTRDST is defined with .type = NLABINARY and .len = sizeofstruct in6addr. For NLABINARY, .len only enforces the maximum payload length and permits...

UBUNTU-CVE-2026-98539

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: use dinstantiatenew in ntfscreateinode and murder syzbot's "WARNING in donewmount" saga ntfscreateinode creates a new inode via ntfsnewinode. It hashes it with insertinodelocked and so it's marked as INEW until...

UBUNTU-CVE-2026-98551

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fill branch entries with a single assignment perfclearbranchentrybitfields clears the bitfields of struct perfbranchentry one by one and leaves from/to alone, since callers overwrite those straight away. The list has t...

UBUNTU-CVE-2026-98535

In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in readdtsnode ofclkget returns a clock with its reference count incremented, but readdtsnode only uses it to read the rate and never calls clkput. The clock is not stored anywhere, so the referen...

UBUNTU-CVE-2026-98536

In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanupofflinecgwbsworkfn drains a dying cgwb by calling cleanupofflinecgwb until it returns false, with a condresched between passes. On a CONFIGPREEMPTION kernel...

UBUNTU-CVE-2026-98511

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveaubopinlocked nouveaubopinlocked checks whether an already pinned BO is in a memory domain compatible with a new pin request. When the domains are incompatible, it sets...

UBUNTU-CVE-2026-98538

In the Linux kernel, the following vulnerability has been resolved: writeback: bound cleanupofflinecgwb rescans by rotating scanned inodes cleanupofflinecgwb prepares at most WBMAXINODESPERISW inodes per call and is called again until the dying wb is drained, but every call walks wb-battached and...

UBUNTU-CVE-2026-98517

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveauuvmmsm when BO is in TTMPLSYSTEM nouveauuvmmsm calls opmap, which passes bo-resource through nouveaumem to nouveauuvmamap. nouveauuvmmvmmmap then reads mem-mem.type. But this is only valid when...

UBUNTU-CVE-2026-98525

In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag list in mctplookupprealloctag When a socket transmits a packet with MCTPTAGPREALLOC set, mctplookupprealloctag iterates over the per-netns &mns-keys list and matches netid, reqtag, peeraddr, and...

UBUNTU-CVE-2026-98510

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

UBUNTU-CVE-2026-98863

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Re-pend GETNESTEDSTATEPAGES if getting said pages fails Re-pend GETNESTEDSTATEPAGES before exiting to userspace if getting the nested pages fails in the KVMRUN path. If userspace re-runs the vCPU, and vmcs02 holds valid...

CVE-2026-98530

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix permanent hang when flushing the kprobe optimizer Writing 0 to /proc/sys/debug/kprobes-optimization while a kprobe is jump-optimized never returns. The writer sleeps in D state forever with kprobesysctlmutex held, so...

CVE-2026-98706

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, and can update numstaps and the...

CVE-2026-98481

In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100recvresponse passes the URB transfer buffer to port100rxframeisvalid, which checksums le16tocpuframe-datalen bytes of frame-data. datalen is a...

CVE-2026-98496

In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdtwork after releasing the WDT IRQ airohanpuremove calls cancelworksync on each core's wdtwork, but the watchdog IRQ that queues it is requested with devmrequestirq and is freed only after .remove return...

CVE-2026-98491

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1...

CVE-2026-98631

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...

UBUNTU-CVE-2026-98836

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: reject oversized playback packets Each playback URB is handed a slice of out.buffer that is exactly LINE6ISOPACKETS maxpacketsizeout bytes, sized from the OUT endpoint, but the number of bytes written into that slice...

CVE-2026-98527

In the Linux kernel, the following vulnerability has been resolved: gpio: zynq: fix runtime PM leak on request error path pmruntimegetsync leaves the usage counter incremented even when it fails, and zynqgpiorequest returns the error without dropping it. gpiolib does not call -free when -request...