UBUNTU-CVE-2026-98598

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6insertexception for dying fib6info. Before the cited commit, fib6nhflushexceptions always set from-exceptionbucketflushed = 1 under rt6exceptionlock to prevent rt6insertexception from inserting a new exception fo...

UBUNTU-CVE-2026-98600

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcommrecvframe While rfcommrecvframe verifies that skb-len is at least sizeofhdr + 1 4 bytes: 3-byte header + 1-byte FCS, an RFCOMM frame with an extended 2-byte length field...

UBUNTU-CVE-2026-98607

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leaks in virtiogpuresourcecreateblobioctl virtiogpuresourcecreateblobioctl calls drmgemobjectrelease on both the virtiogpuresourceassignuuid and drmgemhandlecreate error paths instead of dropping the...

UBUNTU-CVE-2026-98611

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpfcryptoctxcreate is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that paramssz bytes of params are valid. The function...

UBUNTU-CVE-2026-98615

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Set AWFLUSHMODE alongside AWFLUSH when flushing the mailbox When tearing down the FW mailbox Rx ring, fbnicmbxresetdescring writes AWCFG with FLUSH set and everything else, BME included, cleared. Clearing BME halts th...

UBUNTU-CVE-2026-98618

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx and Rx queue. fbnic's allocation path excludes FBNICMAXTXQS from that layout. A 64-Tx/64-Rx configuration therefore records 128...

UBUNTU-CVE-2026-98623

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkmclkustateupdate If listforeachentry exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead. The check is reachable fr...

UBUNTU-CVE-2026-98627

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe regsafe maps packet pointer IDs between states and checks that each current register range is a subset of the corresponding explored register range. It does not, however,...

UBUNTU-CVE-2026-98629

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it und...

UBUNTU-CVE-2026-98632

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending meshsendsync entries on cancel In sendcancel, pending meshtx objects are removed from the hdev-meshpending list and freed via meshsendcomplete. However, if a mesh transmission was already queued...

UBUNTU-CVE-2026-98640

In the Linux kernel, the following vulnerability has been resolved: HID: amdsfh: Validate PCI BAR size before mapping The amdsfh driver maps PCI BAR 2 using pcimiomapregions and subsequently accesses MMIO registers at offsets up to 0x10958 e.g., AMDP2CMSG3 at 0x1068C. However, the driver never...

UBUNTU-CVE-2026-98658

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validate firmware data length The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond...

CVE-2026-98557

In the Linux kernel, the following vulnerability has been resolved: gve: DQO: fix header length used by gvecansendtso for UDP GSO gvecansendtso computes how many buffers each segment of a GSO packet would span, and for this it needs the length of the headers that the device replicates in front of...

CVE-2026-98645

In the Linux kernel, the following vulnerability has been resolved: HID: winwing: fix use-after-free in force feedback teardown winwinginitff passes the driver's private data, allocated with devmkzalloc in winwingprobe, as the effect context to inputffcreatememless. The memoryless force-feedback...

CVE-2026-98688

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL dereference in tbremovework There is a slight race between tbremovework and tbdomainremove which leads to dereferencing a NULL tb-rootswitch pointer inside tbfreeunpluggedxdomains: Thread A Thread B...

CVE-2026-98815

In the Linux kernel, the following vulnerability has been resolved: nvme: fix cdev lifetime Sashiko bot reported a potential problem for the cdev lifetime in 0 - the code there is heavily based on the NVMe code. Currently the NS head .open and .release fileoperations methods take and put a...

CVE-2026-98832

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkgtrygetclosest biosetdev associates the bio with a blkg through bioassociateblkg. If the blkg lookup misses, blkgtrygetclosest takes q-queuelock with spinlockirq and releases it with spinunlockirq...

CVE-2026-98865

In the Linux kernel, the following vulnerability has been resolved: schedext: Don't run ops.dequeue with a DSQ lock held ops.dequeue is invoked with the source user DSQ's lock still held on the consume and move paths scxconsumedispatchq, movetaskbetweendsqs. A BPF scheduler which locks the source...

UBUNTU-CVE-2026-98471

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM during intra-host migration Manually perform cache maintenance on the source VM during intra-host migration to ensure no stale data is left in CPU caches after the VM is destroyed...

UBUNTU-CVE-2026-98472

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Free haveruncpus during VM destruction even if VM is no longer SEV Unconditionally free SEV's "have run CPUs" cpumask in the VM destroy path, i.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV V...