UBUNTU-CVE-2026-98587

In the Linux kernel, the following vulnerability has been resolved: firewire: cdev: fix back-transition for isoresourceauto client resource The todo member of isoresourceauto structure represents the state of the client resource and normally transitions in the following order: ISORESAUTOALLOC -...

UBUNTU-CVE-2026-98588

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject maxentries INTMAX in sockmapalloc sockmapalloc only rejects maxentries == 0 and otherwise allows any u32 value. sockmapfree then walks the sks array with a signed int iterator: int i; for i = 0; i...

UBUNTU-CVE-2026-98589

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject pkt arguments in mutating subprogs The verifier tracks changes in how PTRTOPACKET registers' bounds are modified across subprog boundaries. PTRTOPACKET registers are actually passed as PTRTOMEM, which is assumed valid...

UBUNTU-CVE-2026-98590

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpfsock context code generation Currently, the ctx access code reads the rxqueuemapping field with either a 4-byte or 2-byte load. The rest of the bits in the register are marked known zero by the verifier. However, the...

UBUNTU-CVE-2026-98596

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6routeoutputflags, ip6rtputflags, and ip6dstcheck detect an uncached route by listempty&rt-dst.rtuncached, which replaced the static DSTNOCACHE flag check in commit a4c2fd7f7891 "net:...

UBUNTU-CVE-2026-98598

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6insertexception for dying fib6info. Before the cited commit, fib6nhflushexceptions always set from-exceptionbucketflushed = 1 under rt6exceptionlock to prevent rt6insertexception from inserting a new exception fo...

UBUNTU-CVE-2026-98600

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcommrecvframe While rfcommrecvframe verifies that skb-len is at least sizeofhdr + 1 4 bytes: 3-byte header + 1-byte FCS, an RFCOMM frame with an extended 2-byte length field...

UBUNTU-CVE-2026-98604

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpnbind is published through peer-bind with RCU, but local endpoint learning updates bind-local in place under peer-lock. UDP TX reads the field without that lock. In...

UBUNTU-CVE-2026-98606

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: release the GEM object on virtiogpuvramcreate errors virtiogpuvramcreate frees the object with a bare kfreevram on both error paths after drmgemprivateobjectinit has run, and on the second one after...

UBUNTU-CVE-2026-98607

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leaks in virtiogpuresourcecreateblobioctl virtiogpuresourcecreateblobioctl calls drmgemobjectrelease on both the virtiogpuresourceassignuuid and drmgemhandlecreate error paths instead of dropping the...

UBUNTU-CVE-2026-98611

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpfcryptoctxcreate is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that paramssz bytes of params are valid. The function...

UBUNTU-CVE-2026-98615

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Set AWFLUSHMODE alongside AWFLUSH when flushing the mailbox When tearing down the FW mailbox Rx ring, fbnicmbxresetdescring writes AWCFG with FLUSH set and everything else, BME included, cleared. Clearing BME halts th...

UBUNTU-CVE-2026-98616

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: reset numnapi when the napi vectors are freed fbn-numnapi is the count of live napi vectors, each of which owns an IRQ. The PM path had freed them without clearing the count. fbnicpmsuspend tears the datapath down via...

UBUNTU-CVE-2026-98618

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx and Rx queue. fbnic's allocation path excludes FBNICMAXTXQS from that layout. A 64-Tx/64-Rx configuration therefore records 128...

UBUNTU-CVE-2026-98622

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: don't WARN on benign flowoffloadalloc failure flowoffloadalloc returns NULL when the conntrack entry is dying e.g. raced with a conntrack flush or when the GFPATOMIC allocation fails; both are expected under loa...

UBUNTU-CVE-2026-98623

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkmclkustateupdate If listforeachentry exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead. The check is reachable fr...

UBUNTU-CVE-2026-98627

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe regsafe maps packet pointer IDs between states and checks that each current register range is a subset of the corresponding explored register range. It does not, however,...

UBUNTU-CVE-2026-98629

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it und...

UBUNTU-CVE-2026-98632

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending meshsendsync entries on cancel In sendcancel, pending meshtx objects are removed from the hdev-meshpending list and freed via meshsendcomplete. However, if a mesh transmission was already queued...

UBUNTU-CVE-2026-98640

In the Linux kernel, the following vulnerability has been resolved: HID: amdsfh: Validate PCI BAR size before mapping The amdsfh driver maps PCI BAR 2 using pcimiomapregions and subsequently accesses MMIO registers at offsets up to 0x10958 e.g., AMDP2CMSG3 at 0x1068C. However, the driver never...